{ "AdministratorAccess": { "arn": "arn:aws:iam::aws:policy/AdministratorAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:39:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:46.000Z", "lastUpdatedDate": "2015-02-06T18:39:46.000Z" }, "PowerUserAccess": { "arn": "arn:aws:iam::aws:policy/PowerUserAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2015-02-06T18:39:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": "iam:*", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-11-14T22:39:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "iam:*", "organizations:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole", "iam:ListRoles", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-07-06T22:04:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "iam:*", "organizations:*", "account:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole", "iam:ListRoles", "organizations:DescribeOrganization", "account:ListRegions", "account:GetAccountInformation" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-03-20T22:19:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "iam:*", "organizations:*", "account:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole", "iam:ListRoles", "organizations:DescribeOrganization", "account:ListRegions" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-12-06T18:11:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "iam:*", "organizations:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" } ] } }, "v6": { "createdDate": "2015-02-06T18:39:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "iam:*", "organizations:*", "account:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetPrimaryEmail", "account:ListRegions", "iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole", "iam:ListRoles", "organizations:DescribeOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:47.000Z", "lastUpdatedDate": "2024-08-19T16:12:55.000Z" }, "ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ReadOnlyAccess", "latestVersionId": "v128", "versionsCount": 128, "versions": { "v2": { "createdDate": "2015-04-21T16:37:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "directconnect:Describe*", "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:Read*", "elastictranscoder:List*", "iam:List*", "iam:GenerateCredentialReport", "iam:Get*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "opsworks:Describe*", "opsworks:Get*", "route53:Get*", "route53:List*", "redshift:Describe*", "redshift:ViewQueriesInConsole", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:List*", "storagegateway:Describe*", "tag:get*", "trustedadvisor:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "directconnect:Describe*", "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "elasticache:Describe*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:Read*", "elastictranscoder:List*", "iam:List*", "iam:Get*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "opsworks:Describe*", "opsworks:Get*", "route53:Get*", "route53:List*", "redshift:Describe*", "redshift:ViewQueriesInConsole", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:List*", "storagegateway:Describe*", "tag:get*", "trustedadvisor:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2015-10-15T17:55:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "firehose:Describe*", "firehose:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2015-06-15T22:15:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2015-11-02T23:13:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "firehose:Describe*", "firehose:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2016-01-28T00:02:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v10": { "createdDate": "2016-03-10T19:51:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2015-12-23T00:19:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2015-12-21T20:07:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v12": { "createdDate": "2016-05-12T21:16:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v14": { "createdDate": "2016-06-02T18:28:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v13": { "createdDate": "2016-05-25T00:04:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2015-10-21T00:16:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "firehose:Describe*", "firehose:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v11": { "createdDate": "2016-05-05T21:28:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudTrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v15": { "createdDate": "2016-06-20T21:12:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v23": { "createdDate": "2017-02-13T20:51:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v22": { "createdDate": "2017-01-26T21:25:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v16": { "createdDate": "2016-08-23T17:10:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v19": { "createdDate": "2016-11-15T00:27:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v17": { "createdDate": "2016-09-06T17:05:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:GetAuthorizationToken", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v20": { "createdDate": "2016-12-01T22:19:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v18": { "createdDate": "2016-10-31T22:35:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:GetAuthorizationToken", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetManifest", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v21": { "createdDate": "2017-01-04T22:19:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v24": { "createdDate": "2017-03-20T18:53:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v25": { "createdDate": "2017-04-07T18:20:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v29": { "createdDate": "2017-07-20T17:43:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "directconnect:Confirm*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v28": { "createdDate": "2017-06-29T19:42:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "directconnect:Confirm*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v31": { "createdDate": "2018-01-06T00:12:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v26": { "createdDate": "2017-05-17T23:03:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects", "codebuild:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetAccountLimits", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGetItem", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:ListDomainNames", "es:ListTags", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:DescribeJob", "glacier:GetJobOutput", "health:Describe*", "health:Get*", "health:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:PreviewAgentsForResourceGroup", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:ListStateMachines", "states:ListActivities", "states:DescribeStateMachine", "states:ListExecutions", "states:DescribeExecution", "states:GetExecutionHistory", "states:DescribeActivity", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v27": { "createdDate": "2017-06-14T22:09:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:LookupDeveloperIdentity", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:SearchGameSessions", "glacier:List*", "glacier:Describe*", "glacier:Get*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:Get*", "route53domains:List*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:ReceiveMessage", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v33": { "createdDate": "2018-03-20T18:29:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v30": { "createdDate": "2017-11-06T23:05:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v32": { "createdDate": "2018-02-07T00:10:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v34": { "createdDate": "2018-06-06T17:57:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:View*", "redshift:Get*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v35": { "createdDate": "2018-06-27T22:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v36": { "createdDate": "2018-07-25T18:46:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:Get*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v38": { "createdDate": "2018-08-13T19:15:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v39": { "createdDate": "2018-08-28T22:22:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v37": { "createdDate": "2018-07-30T17:48:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "ses:Get*", "ses:List*", "ses:Describe*", "ses:Verify*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v41": { "createdDate": "2018-09-12T22:05:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v40": { "createdDate": "2018-09-04T21:08:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeSubnetGroups", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v42": { "createdDate": "2018-10-15T18:41:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v44": { "createdDate": "2019-01-10T22:37:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v43": { "createdDate": "2018-11-08T20:20:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:List*", "cognito-identity:Describe*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v46": { "createdDate": "2019-03-04T23:53:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGateway", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v45": { "createdDate": "2019-02-05T18:19:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v48": { "createdDate": "2019-04-02T19:07:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v47": { "createdDate": "2019-03-18T22:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "apigateway:GET", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "application-autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:List*", "athena:Batch*", "athena:Get*", "autoscaling:Describe*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:Get*", "lightsail:Is*", "lightsail:Download*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v49": { "createdDate": "2019-05-30T23:39:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v50": { "createdDate": "2019-06-03T20:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v52": { "createdDate": "2019-07-23T18:41:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v51": { "createdDate": "2019-06-26T21:54:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdates", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:List*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v53": { "createdDate": "2019-08-21T18:46:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v54": { "createdDate": "2019-08-21T23:33:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "aesop:Get*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v55": { "createdDate": "2019-09-20T18:28:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "aesop:Get*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetResources", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:GetTagKeys", "lightsail:GetTagValues", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v56": { "createdDate": "2019-10-01T18:46:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "aesop:Get*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v58": { "createdDate": "2019-11-26T01:37:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v57": { "createdDate": "2019-11-22T01:10:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "aesop:Get*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v59": { "createdDate": "2020-01-15T22:48:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudformation:Preview*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:Get*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "lightsail:List*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "s3:Head*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*", "ram:Get*", "ram:List*", "eks:List*", "eks:Describe*", "config:select-resource-config", "mgh:GetHomeRegion", "elemental-appliances-software:List*", "elemental-appliances-software:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v60": { "createdDate": "2020-01-22T23:52:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*", "ram:Get*", "ram:List*", "eks:List*", "eks:Describe*", "config:select-resource-config", "mgh:GetHomeRegion", "elemental-appliances-software:List*", "elemental-appliances-software:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v62": { "createdDate": "2020-03-06T19:30:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource ", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v61": { "createdDate": "2020-02-06T23:35:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource ", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:ListClusters", "eks:ListUpdates", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*", "ram:Get*", "ram:List*", "eks:List*", "eks:Describe*", "config:select-resource-config", "mgh:GetHomeRegion", "elemental-appliances-software:List*", "elemental-appliances-software:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v63": { "createdDate": "2020-03-09T23:45:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v64": { "createdDate": "2020-05-28T21:30:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v69": { "createdDate": "2020-10-15T23:26:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:PutScheduledAction", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScheduledActions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "casssandra.application-autoscaling.amazonaws.com" } } } ] } }, "v66": { "createdDate": "2020-08-13T21:10:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v65": { "createdDate": "2020-06-15T17:12:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v68": { "createdDate": "2020-10-07T22:09:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "freertos:Describe*", "freertos:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v67": { "createdDate": "2020-09-23T20:35:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v70": { "createdDate": "2020-10-15T23:30:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "health:List*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v72": { "createdDate": "2020-12-21T20:41:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "freertos:Describe*", "freertos:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v71": { "createdDate": "2020-10-15T23:36:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "directconnect:Describe*", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:Describe*", "eks:ListClusters", "eks:ListUpdates", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetPartition", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:Describe*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:Get*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v74": { "createdDate": "2021-03-18T21:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "freertos:Describe*", "freertos:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v73": { "createdDate": "2021-01-14T20:07:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:Get*", "acm:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetJob", "amplify:GetDomainAssociation", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:Get*", "appstream:List*", "appsync:Get*", "appsync:List*", "autoscaling:Describe*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "athena:List*", "athena:Batch*", "athena:Get*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:List*", "batch:Describe*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Estimate*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:List*", "codepipeline:Get*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:Verify*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-sync:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:QueryRecords", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Describe*", "cognito-idp:Get*", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectResourceConfig", "connect:List*", "connect:Describe*", "connect:GetFederationToken", "dataexchange:Get*", "dataexchange:List*", "datasync:Describe*", "datasync:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:List*", "devicefarm:Get*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:List*", "discovery:Get*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:List*", "es:Get*", "es:ESHttpGet", "es:ESHttpHead", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "freertos:Describe*", "freertos:List*", "gamelift:List*", "gamelift:Get*", "gamelift:Describe*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetCrawlerMetrics", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobs", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "greengrass:Get*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "kafka:Describe*", "kafka:List*", "kafka:Get*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:List*", "mediapackage:Describe*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "opsworks:Describe*", "opsworks:Get*", "opsworks-cm:List*", "opsworks-cm:Describe*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "rds:Describe*", "rds:List*", "rds:Download*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:List*", "serverlessrepo:Get*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "ses:Get*", "ses:List*", "ses:Describe*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Get*", "snowball:Describe*", "snowball:List*", "sns:Get*", "sns:List*", "sns:Check*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso:Get*", "sso:Describe*", "sso:List*", "sso:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "states:List*", "states:Describe*", "states:GetExecutionHistory", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "transcribe:Get*", "transcribe:List*", "trustedadvisor:Describe*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "waf-regional:List*", "waf-regional:Get*", "workdocs:Describe*", "workdocs:Get*", "workdocs:CheckAlias", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v75": { "createdDate": "2021-04-13T21:31:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCloudFormationStackRecords", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v76": { "createdDate": "2021-04-21T16:03:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v78": { "createdDate": "2021-05-25T23:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListPackages", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-notifications:ListTargets", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperimentTemplates", "fis:ListExperiments", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemaVersions", "glue:ListSchemas", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarmModels", "iotevents:ListAlarms", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectorModels", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "iotwireless:ListWirelessGateways", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSourceSyncJobs", "kendra:ListDataSources", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetLoadBalancers", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v79": { "createdDate": "2021-09-08T19:43:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v80": { "createdDate": "2021-09-09T00:01:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v77": { "createdDate": "2021-05-21T17:31:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListPackages", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-notifications:ListTargets", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperimentTemplates", "fis:ListExperiments", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:RequestUploadCredentials", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetMapping", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemaVersions", "glue:ListSchemas", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarmModels", "iotevents:ListAlarms", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectorModels", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "iotwireless:ListWirelessGateways", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeThesaurus", "kendra:ListDataSourceSyncJobs", "kendra:ListDataSources", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:Get*", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetLoadBalancers", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v83": { "createdDate": "2022-02-16T20:46:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlerts", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListRules", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListVirtualClusters", "emr-containers:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinations", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkers", "iotroborunner:ListWorkerFleets", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetNetwork", "managedblockchain:GetProposal", "managedblockchain:GetMember", "managedblockchain:GetNode", "managedblockchain:ListNetworks", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListApps", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v81": { "createdDate": "2021-10-08T19:08:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlerts", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListRules", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetNetwork", "managedblockchain:GetProposal", "managedblockchain:GetMember", "managedblockchain:GetNode", "managedblockchain:ListNetworks", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v82": { "createdDate": "2021-10-26T20:14:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlerts", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListRules", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetNetwork", "managedblockchain:GetProposal", "managedblockchain:GetMember", "managedblockchain:GetNode", "managedblockchain:ListNetworks", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v84": { "createdDate": "2022-04-12T19:46:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlerts", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListRules", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListVirtualClusters", "emr-containers:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinations", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkers", "iotroborunner:ListWorkerFleets", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:DescribeExperience", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie:ListMemberAccounts", "macie:ListS3Resources", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetNetwork", "managedblockchain:GetProposal", "managedblockchain:GetMember", "managedblockchain:GetNode", "managedblockchain:ListNetworks", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListFlows", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnections", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "redshift:View*", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListApps", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "route53resolver:List*", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:Get*", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v89": { "createdDate": "2022-07-25T21:19:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v90": { "createdDate": "2022-07-29T19:19:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v85": { "createdDate": "2022-05-04T18:38:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "macie:ListMemberAccounts", "macie:ListS3Resources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v86": { "createdDate": "2022-05-06T21:06:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetStreamSession", "ivs:ListStreamSessions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "macie:ListMemberAccounts", "macie:ListS3Resources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v87": { "createdDate": "2022-05-23T20:16:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetStreamSession", "ivs:ListStreamSessions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:List*", "lookoutmetrics:Get*", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "macie:ListMemberAccounts", "macie:ListS3Resources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v88": { "createdDate": "2022-07-06T17:26:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:DescribeOrganizationConfiguration", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v94": { "createdDate": "2022-12-13T17:29:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetSegment", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListSegmentReferences", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecasts", "forecast:ListWhatIfForecastExports", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v91": { "createdDate": "2022-08-24T20:17:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "worklink:Describe*", "worklink:List*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v92": { "createdDate": "2022-10-04T21:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:QueryForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v93": { "createdDate": "2022-11-02T17:58:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetSegment", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListSegmentReferences", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecasts", "forecast:ListWhatIfForecastExports", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetAction", "iotroborunner:GetActionTemplate", "iotroborunner:GetActivity", "iotroborunner:GetDestination", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetSite", "iotroborunner:GetTask", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListActions", "iotroborunner:ListActionTemplates", "iotroborunner:ListActivities", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListTasks", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetRoom", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v95": { "createdDate": "2023-01-11T22:47:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetSegment", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListSegmentReferences", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecasts", "forecast:ListWhatIfForecastExports", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v96": { "createdDate": "2023-02-10T22:36:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlowExecution", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v97": { "createdDate": "2023-03-03T16:08:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobilehub:Describe*", "mobilehub:Export*", "mobilehub:Generate*", "mobilehub:Get*", "mobilehub:List*", "mobilehub:Validate*", "mobilehub:Verify*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v99": { "createdDate": "2023-04-27T19:19:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v101": { "createdDate": "2023-06-13T17:12:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v102": { "createdDate": "2023-06-15T23:41:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v98": { "createdDate": "2023-03-13T18:25:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v100": { "createdDate": "2023-05-08T15:09:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetFederationToken", "connect:List*", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetPartnerAccount", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListPartnerAccounts", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "outposts:Get*", "outposts:List*", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v103": { "createdDate": "2023-07-10T17:02:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v104": { "createdDate": "2023-08-07T14:47:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetSchema", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:Get*", "lambda:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v105": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:Detect*", "rekognition:List*", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v106": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v107": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:Get*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v108": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "gamesparks:GetExtension", "gamesparks:GetExtensionVersion", "gamesparks:GetGame", "gamesparks:GetGameConfiguration", "gamesparks:GetGeneratedCodeJob", "gamesparks:GetPlayerConnectionStatus", "gamesparks:GetSnapshot", "gamesparks:GetStage", "gamesparks:GetStageDeployment", "gamesparks:ListExtensions", "gamesparks:ListExtensionVersions", "gamesparks:ListGames", "gamesparks:ListGeneratedCodeJobs", "gamesparks:ListSnapshots", "gamesparks:ListStageDeployments", "gamesparks:ListStages", "gamesparks:ListTagsForResource", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v109": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperiments", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v110": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListProvisionedApps", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v111": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:ListChannels", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v112": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v113": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v114": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliasReplicas", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBotVersionReplicas", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v115": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServices", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliasReplicas", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBotVersionReplicas", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v116": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServices", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliasReplicas", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBotVersionReplicas", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v117": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServices", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms-ml:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTables", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetrics", "iotwireless:GetMetricConfiguration", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreams", "ivs:ListStreamKeys", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliasReplicas", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBotVersionReplicas", "lex:ListBots", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v118": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v119": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v120": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlows", "bedrock:ListFlowAliases", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetPublicKey", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v121": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlows", "bedrock:ListFlowAliases", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetPublicKey", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v122": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v123": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:DescribeInstanceImageMetadata", "ec2:Describe*", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v124": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "aiops:GetInvestigation", "aiops:GetInvestigationEvent", "aiops:GetInvestigationGroup", "aiops:GetInvestigationResource", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "apptest:GetTestCase", "apptest:GetTestConfiguration", "apptest:GetTestRunStep", "apptest:GetTestSuite", "apptest:ListTagsForResource", "apptest:ListTestCases", "apptest:ListTestConfigurations", "apptest:ListTestRuns", "apptest:ListTestRunSteps", "apptest:ListTestRunTestCases", "apptest:ListTestSuites", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetAutoshiftObserverNotificationStatus", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCommitmentPurchaseAnalysis", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCommitmentPurchaseAnalyses", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListAssociations", "chatbot:ListCustomActions", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetIdleRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:DescribeInstanceImageMetadata", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListIntegrations", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "observabilityadmin:GetTelemetryEvaluationStatus", "observabilityadmin:GetTelemetryEvaluationStatusForOrganization", "observabilityadmin:ListResourceTelemetry", "observabilityadmin:ListResourceTelemetryForOrganization", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeMetricsExport", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListMetrics", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v125": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "aiops:GetInvestigation", "aiops:GetInvestigationEvent", "aiops:GetInvestigationGroup", "aiops:GetInvestigationResource", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "apptest:GetTestCase", "apptest:GetTestConfiguration", "apptest:GetTestRunStep", "apptest:GetTestSuite", "apptest:ListTagsForResource", "apptest:ListTestCases", "apptest:ListTestConfigurations", "apptest:ListTestRuns", "apptest:ListTestRunSteps", "apptest:ListTestRunTestCases", "apptest:ListTestSuites", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetAutoshiftObserverNotificationStatus", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetCustomerAgreement", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListAgreements", "artifact:ListCustomerAgreements", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCommitmentPurchaseAnalysis", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCommitmentPurchaseAnalyses", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListAssociations", "chatbot:ListCustomActions", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetIdleRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:DescribeInstanceImageMetadata", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListIntegrations", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "observabilityadmin:GetTelemetryEvaluationStatus", "observabilityadmin:GetTelemetryEvaluationStatusForOrganization", "observabilityadmin:ListResourceTelemetry", "observabilityadmin:ListResourceTelemetryForOrganization", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeMetricsExport", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListMetrics", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v126": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetFindingsStatistics", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "aiops:GetInvestigation", "aiops:GetInvestigationEvent", "aiops:GetInvestigationGroup", "aiops:GetInvestigationResource", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "apptest:GetTestCase", "apptest:GetTestConfiguration", "apptest:GetTestRunStep", "apptest:GetTestSuite", "apptest:ListTagsForResource", "apptest:ListTestCases", "apptest:ListTestConfigurations", "apptest:ListTestRuns", "apptest:ListTestRunSteps", "apptest:ListTestRunTestCases", "apptest:ListTestSuites", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetAutoshiftObserverNotificationStatus", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetCustomerAgreement", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListAgreements", "artifact:ListCustomerAgreements", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCommitmentPurchaseAnalysis", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCommitmentPurchaseAnalyses", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListAssociations", "chatbot:ListCustomActions", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetIdleRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:DescribeInstanceImageMetadata", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListIntegrations", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "observabilityadmin:GetTelemetryEvaluationStatus", "observabilityadmin:GetTelemetryEvaluationStatusForOrganization", "observabilityadmin:ListResourceTelemetry", "observabilityadmin:ListResourceTelemetryForOrganization", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeMetricsExport", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListMetrics", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCaseAttributes", "support:DescribeCases", "support:DescribeCommunication", "support:DescribeCommunications", "support:DescribeCreateCaseOptions", "support:DescribeIssueTypes", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeSupportedLanguages", "support:DescribeSupportLevel", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:SearchForCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v127": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetFindingsStatistics", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "aiops:GetInvestigation", "aiops:GetInvestigationEvent", "aiops:GetInvestigationGroup", "aiops:GetInvestigationResource", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBackendEnvironment", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:GetWebhook", "amplify:ListApps", "amplify:ListArtifacts", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "amplify:ListTagsForResource", "amplify:ListWebhooks", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "apptest:GetTestCase", "apptest:GetTestConfiguration", "apptest:GetTestRunStep", "apptest:GetTestSuite", "apptest:ListTagsForResource", "apptest:ListTestCases", "apptest:ListTestConfigurations", "apptest:ListTestRuns", "apptest:ListTestRunSteps", "apptest:ListTestRunTestCases", "apptest:ListTestSuites", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetAutoshiftObserverNotificationStatus", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetCustomerAgreement", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListAgreements", "artifact:ListCustomerAgreements", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentCollaborator", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentCollaborators", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetBillingView", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetResourcePolicy", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:ListSourceViewsForBillingView", "billing:ListTagsForResource", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCommitmentPurchaseAnalysis", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCommitmentPurchaseAnalyses", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:ListAssociations", "chatbot:ListCustomActions", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:ListMicrosoftTeamsUserIdentities", "chatbot:ListTagsForResource", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetIdleRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:DescribeInstanceImageMetadata", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListIntegrations", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetFeatureOptInStatus", "notifications:GetManagedNotificationChildEvent", "notifications:GetManagedNotificationConfiguration", "notifications:GetManagedNotificationEvent", "notifications:GetNotificationConfiguration", "notifications:GetNotificationsAccessForOrganization", "notifications:GetNotificationEvent", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListManagedNotificationChannelAssociations", "notifications:ListManagedNotificationChildEvents", "notifications:ListManagedNotificationConfigurations", "notifications:ListManagedNotificationEvents", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListTagsForResource", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "observabilityadmin:GetTelemetryEvaluationStatus", "observabilityadmin:GetTelemetryEvaluationStatusForOrganization", "observabilityadmin:ListResourceTelemetry", "observabilityadmin:ListResourceTelemetryForOrganization", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeMetricsExport", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListMetrics", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm-quicksetup:GetConfiguration", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:GetServiceSettings", "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCaseAttributes", "support:DescribeCases", "support:DescribeCommunication", "support:DescribeCommunications", "support:DescribeCreateCaseOptions", "support:DescribeIssueTypes", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeSupportedLanguages", "support:DescribeSupportLevel", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:SearchForCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:ListAnswers", "wellarchitected:ListCheckDetails", "wellarchitected:ListCheckSummaries", "wellarchitected:ListLenses", "wellarchitected:ListLensReviewImprovements", "wellarchitected:ListLensReviews", "wellarchitected:ListLensShares", "wellarchitected:ListMilestones", "wellarchitected:ListNotifications", "wellarchitected:ListProfileNotifications", "wellarchitected:ListProfiles", "wellarchitected:ListProfileShares", "wellarchitected:ListReviewTemplateAnswers", "wellarchitected:ListReviewTemplates", "wellarchitected:ListShareInvitations", "wellarchitected:ListTagsForResource", "wellarchitected:ListTemplateShares", "wellarchitected:ListWorkloads", "wellarchitected:ListWorkloadShares", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } }, "v128": { "createdDate": "2015-02-06T18:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*", "access-analyzer:GetAccessPreview", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:GetFindingsStatistics", "access-analyzer:GetGeneratedPolicy", "access-analyzer:ListAccessPreviewFindings", "access-analyzer:ListAccessPreviews", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListPolicyGenerations", "access-analyzer:ListTagsForResource", "access-analyzer:ValidatePolicy", "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "account:ListRegions", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:Describe*", "acm:Get*", "acm:List*", "aiops:GetInvestigation", "aiops:GetInvestigationEvent", "aiops:GetInvestigationGroup", "aiops:GetInvestigationResource", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBackendEnvironment", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:GetJob", "amplify:GetWebhook", "amplify:ListApps", "amplify:ListArtifacts", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:ListJobs", "amplify:ListTagsForResource", "amplify:ListWebhooks", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetAccountSettings", "aoss:GetPoliciesStats", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfiguration", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource", "appflow:DescribeConnector", "appflow:DescribeConnectorEntity", "appflow:DescribeConnectorFields", "appflow:DescribeConnectorProfiles", "appflow:DescribeConnectors", "appflow:DescribeFlow", "appflow:DescribeFlowExecution", "appflow:DescribeFlowExecutionRecords", "appflow:DescribeFlows", "appflow:ListConnectorEntities", "appflow:ListConnectorFields", "appflow:ListConnectors", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "application-autoscaling:ListTagsForResource", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListObservedEntities", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource", "applicationinsights:Describe*", "applicationinsights:List*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:DescribeWebAclForService", "apprunner:ListAssociatedServicesForWebAcl", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListServicesForAutoScalingConfiguration", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appstream:Describe*", "appstream:List*", "appstudio:GetAccountStatus", "appstudio:GetEnablementJobStatus", "appsync:Get*", "appsync:List*", "apptest:GetTestCase", "apptest:GetTestConfiguration", "apptest:GetTestRunStep", "apptest:GetTestSuite", "apptest:ListTagsForResource", "apptest:ListTestCases", "apptest:ListTestConfigurations", "apptest:ListTestRuns", "apptest:ListTestRunSteps", "apptest:ListTestRunTestCases", "apptest:ListTestSuites", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "aps:DescribeRuleGroupsNamespace", "aps:DescribeScraper", "aps:DescribeWorkspace", "aps:GetAlertManagerSilence", "aps:GetAlertManagerStatus", "aps:GetDefaultScraperConfiguration", "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:ListAlertManagerAlertGroups", "aps:ListAlertManagerAlerts", "aps:ListAlertManagerReceivers", "aps:ListAlertManagerSilences", "aps:ListAlerts", "aps:ListRuleGroupsNamespaces", "aps:ListRules", "aps:ListScrapers", "aps:ListTagsForResource", "aps:ListWorkspaces", "aps:QueryMetrics", "arc-zonal-shift:GetAutoshiftObserverNotificationStatus", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:ListAutoshifts", "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts", "artifact:GetCustomerAgreement", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListAgreements", "artifact:ListCustomerAgreements", "artifact:ListReports", "athena:Batch*", "athena:Get*", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:GetAssessmentFramework", "auditmanager:GetAssessmentReportUrl", "auditmanager:GetChangeLogs", "auditmanager:GetControl", "auditmanager:GetDelegations", "auditmanager:GetEvidence", "auditmanager:GetEvidenceByEvidenceFolder", "auditmanager:GetEvidenceFolder", "auditmanager:GetEvidenceFoldersByAssessment", "auditmanager:GetEvidenceFoldersByAssessmentControl", "auditmanager:GetOrganizationAdminAccount", "auditmanager:GetServicesInScope", "auditmanager:GetSettings", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControls", "auditmanager:ListKeywordsForDataSource", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "auditmanager:ValidateAssessmentReportIntegrity", "autoscaling-plans:Describe*", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:Describe*", "autoscaling:GetPredictiveScalingForecast", "aws-portal:View*", "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:GetVirtualMachine", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentCollaborator", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetEvaluationJob", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetKnowledgeBase", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetProvisionedModelThroughput", "bedrock:GetUseCaseForModelAccess", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentCollaborators", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgents", "bedrock:ListAgentVersions", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", "bedrock:ListFlowVersions", "bedrock:ListFoundationModelAgreementOffers", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListInferenceProfiles", "bedrock:ListIngestionJobs", "bedrock:ListKnowledgeBases", "bedrock:ListModelCustomizationJobs", "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetBillingView", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetResourcePolicy", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:ListSourceViewsForBillingView", "billing:ListTagsForResource", "billingconductor:GetBillingGroupCostReport", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroupCostReports", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListCustomLineItemVersions", "billingconductor:ListPricingPlans", "billingconductor:ListPricingPlansAssociatedWithPricingRule", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListResourcesAssociatedToCustomLineItem", "billingconductor:ListTagsForResource", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "budgets:Describe*", "budgets:ListTagsForResource", "budgets:View*", "cassandra:Select", "ce:DescribeCostCategoryDefinition", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetApproximateUsageRecords", "ce:GetCommitmentPurchaseAnalysis", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlanPurchaseRecommendationDetails", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCommitmentPurchaseAnalyses", "ce:ListCostAllocationTagBackfillHistory", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "ce:ListTagsForResource", "chatbot:Describe*", "chatbot:Get*", "chatbot:List*", "chime:Get*", "chime:List*", "chime:Retrieve*", "chime:Search*", "chime:Validate*", "cleanrooms-ml:GetAudienceGenerationJob", "cleanrooms-ml:GetAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModel", "cleanrooms-ml:GetConfiguredAudienceModelPolicy", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListAudienceExportJobs", "cleanrooms-ml:ListAudienceGenerationJobs", "cleanrooms-ml:ListAudienceModels", "cleanrooms-ml:ListConfiguredAudienceModels", "cleanrooms-ml:ListTagsForResource", "cleanrooms-ml:ListTrainingDatasets", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:List*", "clouddirectory:BatchRead", "clouddirectory:Get*", "clouddirectory:List*", "clouddirectory:LookupPolicy", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:Describe*", "cloudhsm:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "codeartifact:DescribeDomain", "codeartifact:DescribePackage", "codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository", "codeartifact:GetAuthorizationToken", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetPackageVersionAsset", "codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersionAssets", "codeartifact:ListPackageVersionDependencies", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListRepositoriesInDomain", "codeartifact:ListTagsForResource", "codeartifact:ReadFromRepository", "codebuild:BatchGet*", "codebuild:DescribeCodeCoverages", "codebuild:DescribeTestCases", "codebuild:List*", "codecatalyst:GetBillingAuthorization", "codecatalyst:GetConnection", "codecatalyst:GetPendingConnection", "codecatalyst:ListConnections", "codecatalyst:ListIamRolesForConnection", "codecatalyst:ListTagsForResource", "codecommit:BatchGet*", "codecommit:Describe*", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*", "codedeploy:BatchGet*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetHost", "codestar-connections:GetRepositoryLink", "codestar-connections:GetRepositorySyncStatus", "codestar-connections:GetResourceSyncStatus", "codestar-connections:GetSyncConfiguration", "codestar-connections:ListConnections", "codestar-connections:ListHosts", "codestar-connections:ListRepositoryLinks", "codestar-connections:ListRepositorySyncDefinitions", "codestar-connections:ListSyncConfigurations", "codestar-connections:ListTagsForResource", "codestar-notifications:describeNotificationRule", "codestar-notifications:listEventTypes", "codestar-notifications:listNotificationRules", "codestar-notifications:listTagsForResource", "codestar-notifications:ListTargets", "codestar:Describe*", "codestar:Get*", "codestar:List*", "codestar:Verify*", "cognito-identity:Describe*", "cognito-identity:GetCredentialsForIdentity", "cognito-identity:GetIdentityPoolAnalytics", "cognito-identity:GetIdentityPoolDailyAnalytics", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetIdentityProviderDailyAnalytics", "cognito-identity:GetOpenIdToken", "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:List*", "cognito-identity:Lookup*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:Describe*", "cognito-idp:Get*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "cognito-sync:QueryRecords", "comprehend:BatchDetect*", "comprehend:Classify*", "comprehend:Contains*", "comprehend:Describe*", "comprehend:Detect*", "comprehend:List*", "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetIdleRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetRecommendationSummaries", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:Describe*", "connect:GetContactAttributes", "connect:GetCurrentMetricData", "connect:GetCurrentUserData", "connect:GetFederationToken", "connect:GetMetricData", "connect:GetMetricDataV2", "connect:GetTaskTemplate", "connect:GetTrafficDistribution", "connect:List*", "consoleapp:GetDeviceIdentity", "consoleapp:ListDeviceIdentities", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "customer-verification:GetCustomerVerificationDetails", "customer-verification:GetCustomerVerificationEligibility", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "databrew:ListTagsForResource", "dataexchange:Get*", "dataexchange:List*", "datapipeline:Describe*", "datapipeline:EvaluateExpression", "datapipeline:Get*", "datapipeline:List*", "datapipeline:QueryObjects", "datapipeline:Validate*", "datasync:Describe*", "datasync:List*", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainSharingPolicy", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptions", "datazone:ListSubscriptionTargets", "datazone:ListTagsForResource", "datazone:ListTimeSeriesDataPoints", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "dax:BatchGetItem", "dax:Describe*", "dax:GetItem", "dax:ListTags", "dax:Query", "dax:Scan", "deadline:BatchGetJobEntity", "deadline:GetApplicationVersion", "deadline:GetBudget", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetSessionsStatisticsAggregation", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", "deadline:ListFarmMembers", "deadline:ListFarms", "deadline:ListFleetMembers", "deadline:ListFleets", "deadline:ListJobMembers", "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers", "deepcomposer:GetComposition", "deepcomposer:GetModel", "deepcomposer:GetSampleModel", "deepcomposer:ListCompositions", "deepcomposer:ListModels", "deepcomposer:ListSampleModels", "deepcomposer:ListTrainingTopics", "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:Get*", "detective:List*", "detective:SearchGraph", "devicefarm:Get*", "devicefarm:List*", "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListOrganizationInsights", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation", "directconnect:Describe*", "discovery:Describe*", "discovery:Get*", "discovery:List*", "dlm:Get*", "dms:Describe*", "dms:List*", "dms:Test*", "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeLaunchConfigurationTemplates", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceNetworks", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListLaunchActions", "drs:ListStagingAccounts", "drs:ListTagsForResource", "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "dynamodb:PartiQLSelect", "dynamodb:Query", "dynamodb:Scan", "ec2:Describe*", "ec2:DescribeInstanceImageMetadata", "ec2:Get*", "ec2:ListImagesInRecycleBin", "ec2:ListSnapshotsInRecycleBin", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ec2messages:Get*", "ecr-public:BatchCheckLayerAvailability", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetAuthorizationToken", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchCheck*", "ecr:BatchGet*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:Request*", "elasticbeanstalk:Retrieve*", "elasticbeanstalk:Validate*", "elasticfilesystem:Describe*", "elasticfilesystem:ListTagsForResource", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:List*", "elasticmapreduce:View*", "elastictranscoder:List*", "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", "emr-containers:DescribeVirtualCluster", "emr-containers:ListJobRuns", "emr-containers:ListManagedEndpoints", "emr-containers:ListTagsForResource", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "emr-serverless:ListTagsForResource", "es:Describe*", "es:ESHttpGet", "es:ESHttpHead", "es:Get*", "es:List*", "events:Describe*", "events:List*", "events:Test*", "evidently:GetExperiment", "evidently:GetExperimentResults", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegmentReferences", "evidently:ListSegments", "evidently:ListTagsForResource", "evidently:TestSegmentPattern", "firehose:Describe*", "firehose:List*", "fis:GetAction", "fis:GetExperiment", "fis:GetExperimentTargetAccountConfiguration", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:GetTargetResourceType", "fis:ListActions", "fis:ListExperimentResolvedTargets", "fis:ListExperiments", "fis:ListExperimentTargetAccountConfigurations", "fis:ListExperimentTemplates", "fis:ListTagsForResource", "fis:ListTargetAccountConfigurations", "fis:ListTargetResourceTypes", "fms:GetAdminAccount", "fms:GetAppsList", "fms:GetComplianceDetail", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:GetProtectionStatus", "fms:GetProtocolsList", "fms:GetViolationDetails", "fms:ListAppsLists", "fms:ListComplianceStatus", "fms:ListMemberAccounts", "fms:ListPolicies", "fms:ListProtocolsLists", "fms:ListTagsForResource", "forecast:DescribeAutoPredictor", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:DescribeDatasetImportJob", "forecast:DescribeExplainability", "forecast:DescribeExplainabilityExport", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribeMonitor", "forecast:DescribePredictor", "forecast:DescribePredictorBacktestExportJob", "forecast:DescribeWhatIfAnalysis", "forecast:DescribeWhatIfForecast", "forecast:DescribeWhatIfForecastExport", "forecast:GetAccuracyMetrics", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListExplainabilities", "forecast:ListExplainabilityExports", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListMonitorEvaluations", "forecast:ListMonitors", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "forecast:ListWhatIfAnalyses", "forecast:ListWhatIfForecastExports", "forecast:ListWhatIfForecasts", "forecast:QueryForecast", "forecast:QueryWhatIfForecast", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:DescribeModelVersions", "frauddetector:GetBatchImportJobs", "frauddetector:GetBatchPredictionJobs", "frauddetector:GetDeleteEventsByEventTypeStatus", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEvent", "frauddetector:GetEventPredictionMetadata", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetKMSEncryptionKey", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModels", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListEventPredictions", "frauddetector:ListTagsForResource", "freertos:Describe*", "freertos:List*", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "fsx:Describe*", "fsx:List*", "gamelift:Describe*", "gamelift:Get*", "gamelift:List*", "gamelift:ResolveAlias", "gamelift:Search*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:BatchGetCrawlers", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchGetTriggers", "glue:BatchGetWorkflows", "glue:CheckSchemaVersionValidity", "glue:GetCatalogImportStatus", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlerMetrics", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDataflowGraph", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobBookmark", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:GetMapping", "glue:GetMLTaskRun", "glue:GetMLTaskRuns", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetPlan", "glue:GetRegistry", "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetTrigger", "glue:GetTriggers", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:GetWorkflow", "glue:GetWorkflowRun", "glue:GetWorkflowRunProperties", "glue:GetWorkflowRuns", "glue:ListCrawlers", "glue:ListCrawls", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:ListTriggers", "glue:ListWorkflows", "glue:QuerySchemaVersionMetadata", "glue:SearchTables", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListPermissions", "grafana:ListTagsForResource", "grafana:ListVersions", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:Get*", "greengrass:List*", "groundstation:DescribeContact", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMinuteUsage", "groundstation:GetMissionProfile", "groundstation:GetSatellite", "groundstation:ListConfigs", "groundstation:ListContacts", "groundstation:ListDataflowEndpointGroups", "groundstation:ListGroundStations", "groundstation:ListMissionProfiles", "groundstation:ListSatellites", "groundstation:ListTagsForResource", "guardduty:Describe*", "guardduty:Get*", "guardduty:List*", "health:Describe*", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRExportJob", "healthlake:DescribeFHIRImportJob", "healthlake:GetCapabilities", "healthlake:ListFHIRDatastores", "healthlake:ListFHIRExportJobs", "healthlake:ListFHIRImportJobs", "healthlake:ListTagsForResource", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost", "iam:Generate*", "iam:Get*", "iam:List*", "iam:Simulate*", "identity-sync:GetSyncProfile", "identity-sync:GetSyncTarget", "identity-sync:ListSyncFilters", "identitystore-auth:BatchGetSession", "identitystore-auth:ListSessions", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:DescribeUser", "identitystore:GetGroupId", "identitystore:GetGroupMembershipId", "identitystore:GetUserId", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "imagebuilder:Get*", "imagebuilder:List*", "importexport:Get*", "importexport:List*", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCisScans", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "iot:Describe*", "iot:Get*", "iot:List*", "iot1click:DescribeDevice", "iot1click:DescribePlacement", "iot1click:DescribeProject", "iot1click:GetDeviceMethods", "iot1click:GetDevicesInPlacement", "iot1click:ListDeviceEvents", "iot1click:ListDevices", "iot1click:ListPlacements", "iot1click:ListProjects", "iot1click:ListTagsForResource", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "iotanalytics:SampleChannelData", "iotevents:DescribeAlarm", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetector", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:DescribeLoggingOptions", "iotevents:ListAlarmModels", "iotevents:ListAlarmModelVersions", "iotevents:ListAlarms", "iotevents:ListDetectorModels", "iotevents:ListDetectorModelVersions", "iotevents:ListDetectors", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleethub:DescribeApplication", "iotfleethub:ListApplications", "iotfleetwise:GetCampaign", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetLoggingOptions", "iotfleetwise:GetModelManifest", "iotfleetwise:GetRegisterAccountStatus", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:GetVehicleStatus", "iotfleetwise:ListCampaigns", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListFleetsForVehicle", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotfleetwise:ListVehiclesInFleet", "iotroborunner:GetDestination", "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations", "iotroborunner:ListSites", "iotroborunner:ListWorkerFleets", "iotroborunner:ListWorkers", "iotsitewise:Describe*", "iotsitewise:Get*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetEventConfigurationByResourceTypes", "iotwireless:GetFuotaTask", "iotwireless:GetLogLevelsByResourceTypes", "iotwireless:GetMetricConfiguration", "iotwireless:GetMetrics", "iotwireless:GetMulticastGroup", "iotwireless:GetMulticastGroupSession", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetPartnerAccount", "iotwireless:GetPosition", "iotwireless:GetPositionConfiguration", "iotwireless:GetPositionEstimate", "iotwireless:GetResourceEventConfiguration", "iotwireless:GetResourceLogLevel", "iotwireless:GetResourcePosition", "iotwireless:GetServiceEndpoint", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessDeviceImportTask", "iotwireless:GetWirelessDeviceStatistics", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayCertificate", "iotwireless:GetWirelessGatewayFirmwareInformation", "iotwireless:GetWirelessGatewayStatistics", "iotwireless:GetWirelessGatewayTask", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListDevicesForWirelessDeviceImportTask", "iotwireless:ListEventConfigurations", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListMulticastGroupsByFuotaTask", "iotwireless:ListNetworkAnalyzerConfigurations", "iotwireless:ListPartnerAccounts", "iotwireless:ListPositionConfigurations", "iotwireless:ListQueuedMessages", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDeviceImportTasks", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipantEvents", "ivs:ListParticipants", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:Describe*", "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:Get*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafka:ListClusterOperations", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurationRevisions", "kafka:ListConfigurations", "kafka:ListKafkaVersions", "kafka:ListNodes", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:DescribeCustomPlugin", "kafkaconnect:DescribeWorkerConfiguration", "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations", "kendra:BatchGetDocumentStatus", "kendra:DescribeDataSource", "kendra:DescribeExperience", "kendra:DescribeFaq", "kendra:DescribeIndex", "kendra:DescribePrincipalMapping", "kendra:DescribeQuerySuggestionsBlockList", "kendra:DescribeQuerySuggestionsConfig", "kendra:DescribeThesaurus", "kendra:GetQuerySuggestions", "kendra:GetSnapshots", "kendra:ListDataSources", "kendra:ListDataSourceSyncJobs", "kendra:ListEntityPersonas", "kendra:ListExperienceEntities", "kendra:ListExperiences", "kendra:ListFaqs", "kendra:ListGroupsOlderThanOrderingId", "kendra:ListIndices", "kendra:ListQuerySuggestionsBlockLists", "kendra:ListTagsForResource", "kendra:ListThesauri", "kendra:Query", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Discover*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:DescribeResource", "lakeformation:GetDataCellsFilter", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GetLfTag", "lakeformation:GetResourceLfTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLfTags", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:ListTableStorageOptimizers", "lakeformation:SearchDatabasesByLfTags", "lakeformation:SearchTablesByLfTags", "lambda:Get*", "lambda:List*", "launchwizard:DescribeAdditionalNode", "launchwizard:DescribeProvisionedApp", "launchwizard:DescribeProvisioningEvents", "launchwizard:DescribeSettingsSet", "launchwizard:GetDeployment", "launchwizard:GetInfrastructureSuggestion", "launchwizard:GetIpAddress", "launchwizard:GetResourceCostEstimate", "launchwizard:GetResourceRecommendation", "launchwizard:GetSettingsSet", "launchwizard:GetWorkload", "launchwizard:GetWorkloadAsset", "launchwizard:GetWorkloadAssets", "launchwizard:GetWorkloadDeploymentPattern", "launchwizard:ListAdditionalNodes", "launchwizard:ListAllowedResources", "launchwizard:ListDeploymentEvents", "launchwizard:ListDeployments", "launchwizard:ListProvisionedApps", "launchwizard:ListResourceCostEstimates", "launchwizard:ListSettingsSets", "launchwizard:ListTagsForResource", "launchwizard:ListWorkloadDeploymentOptions", "launchwizard:ListWorkloadDeploymentPatterns", "launchwizard:ListWorkloads", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:Get*", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotLocales", "lex:ListBotReplicas", "lex:ListBots", "lex:ListBotVersionReplicas", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "license-manager:Get*", "license-manager:List*", "lightsail:GetActiveNames", "lightsail:GetAlarms", "lightsail:GetAutoSnapshots", "lightsail:GetBlueprints", "lightsail:GetBucketAccessKeys", "lightsail:GetBucketBundles", "lightsail:GetBucketMetricData", "lightsail:GetBuckets", "lightsail:GetBundles", "lightsail:GetCertificates", "lightsail:GetCloudFormationStackRecords", "lightsail:GetContainerAPIMetadata", "lightsail:GetContainerImages", "lightsail:GetContainerServiceDeployments", "lightsail:GetContainerServiceMetricData", "lightsail:GetContainerServicePowers", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributionBundles", "lightsail:GetDistributionLatestCacheReset", "lightsail:GetDistributionMetricData", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetExportSnapshotRecords", "lightsail:GetInstance", "lightsail:GetInstanceMetricData", "lightsail:GetInstancePortStates", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceState", "lightsail:GetKeyPair", "lightsail:GetKeyPairs", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancerMetricData", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetOperation", "lightsail:GetOperations", "lightsail:GetOperationsForResource", "lightsail:GetRegions", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseBlueprints", "lightsail:GetRelationalDatabaseBundles", "lightsail:GetRelationalDatabaseEvents", "lightsail:GetRelationalDatabaseLogEvents", "lightsail:GetRelationalDatabaseLogStreams", "lightsail:GetRelationalDatabaseMetricData", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "lightsail:Is*", "logs:Describe*", "logs:FilterLogEvents", "logs:Get*", "logs:ListIntegrations", "logs:ListAnomalies", "logs:ListEntitiesForLogGroup", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:StartLiveTail", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:DescribeLabel", "lookoutequipment:DescribeLabelGroup", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeModelVersion", "lookoutequipment:DescribeResourcePolicy", "lookoutequipment:DescribeRetrainingScheduler", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListDatasets", "lookoutequipment:ListInferenceEvents", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListLabelGroups", "lookoutequipment:ListLabels", "lookoutequipment:ListModels", "lookoutequipment:ListModelVersions", "lookoutequipment:ListRetrainingSchedulers", "lookoutequipment:ListSensorStatistics", "lookoutequipment:ListTagsForResource", "lookoutmetrics:Describe*", "lookoutmetrics:Get*", "lookoutmetrics:List*", "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "m2:GetApplication", "m2:GetApplicationVersion", "m2:GetBatchJobExecution", "m2:GetDataSetDetails", "m2:GetDataSetImportTask", "m2:GetDeployment", "m2:GetEnvironment", "m2:ListApplications", "m2:ListApplicationVersions", "m2:ListBatchJobDefinitions", "m2:ListBatchJobExecutions", "m2:ListDataSetImportHistory", "m2:ListDataSets", "m2:ListDeployments", "m2:ListEngineVersions", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "machinelearning:Get*", "macie2:BatchGetCustomDataIdentifiers", "macie2:DescribeBuckets", "macie2:DescribeClassificationJob", "macie2:DescribeOrganizationConfiguration", "macie2:GetAdministratorAccount", "macie2:GetAllowList", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetBucketStatistics", "macie2:GetClassificationExportConfiguration", "macie2:GetClassificationScope", "macie2:GetCustomDataIdentifier", "macie2:GetFindings", "macie2:GetFindingsFilter", "macie2:GetFindingsPublicationConfiguration", "macie2:GetFindingStatistics", "macie2:GetInvitationsCount", "macie2:GetMacieSession", "macie2:GetMember", "macie2:GetResourceProfile", "macie2:GetRevealConfiguration", "macie2:GetSensitiveDataOccurrencesAvailability", "macie2:GetSensitivityInspectionTemplate", "macie2:GetUsageStatistics", "macie2:GetUsageTotals", "macie2:ListAllowLists", "macie2:ListAutomatedDiscoveryAccounts", "macie2:ListClassificationJobs", "macie2:ListClassificationScopes", "macie2:ListCustomDataIdentifiers", "macie2:ListFindings", "macie2:ListFindingsFilters", "macie2:ListInvitations", "macie2:ListMembers", "macie2:ListOrganizationAdminAccounts", "macie2:ListResourceProfileArtifacts", "macie2:ListResourceProfileDetections", "macie2:ListSensitivityInspectionTemplates", "macie2:ListTagsForResource", "macie2:SearchResources", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:GetProposal", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNetworks", "managedblockchain:ListNodes", "managedblockchain:ListProposals", "managedblockchain:ListProposalVotes", "managedblockchain:ListTagsForResource", "mediaconnect:DescribeFlow", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListTagsForResource", "mediaconvert:DescribeEndpoints", "mediaconvert:Get*", "mediaconvert:List*", "medialive:DescribeChannel", "medialive:DescribeInput", "medialive:DescribeInputDevice", "medialive:DescribeInputDeviceThumbnail", "medialive:DescribeInputSecurityGroup", "medialive:DescribeMultiplex", "medialive:DescribeMultiplexProgram", "medialive:DescribeOffering", "medialive:DescribeReservation", "medialive:DescribeSchedule", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:ListChannels", "medialive:ListCloudWatchAlarmTemplateGroups", "medialive:ListCloudWatchAlarmTemplates", "medialive:ListEventBridgeRuleTemplateGroups", "medialive:ListEventBridgeRuleTemplates", "medialive:ListInputDevices", "medialive:ListInputDeviceTransfers", "medialive:ListInputs", "medialive:ListInputSecurityGroups", "medialive:ListMultiplexes", "medialive:ListMultiplexPrograms", "medialive:ListOfferings", "medialive:ListReservations", "medialive:ListSignalMaps", "medialive:ListTagsForResource", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetHeadObject", "mediapackagev2:GetObject", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:ListChannelGroups", "mediapackagev2:ListChannels", "mediapackagev2:ListOriginEndpoints", "mediapackagev2:ListTagsForResource", "mediastore:DescribeContainer", "mediastore:DescribeObject", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:GetLifecyclePolicy", "mediastore:GetMetricPolicy", "mediastore:GetObject", "mediastore:ListContainers", "mediastore:ListItems", "mediastore:ListTagsForResource", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:ListTags", "mgh:Describe*", "mgh:GetHomeRegion", "mgh:List*", "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeLaunchConfigurationTemplates", "mgn:DescribeReplicationConfigurationTemplates", "mgn:DescribeSourceServers", "mgn:DescribeVcenterClients", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration", "mgn:ListApplications", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListWaves", "mobileanalytics:Get*", "mobiletargeting:Get*", "mobiletargeting:List*", "monitron:GetProject", "monitron:GetProjectAdminUser", "monitron:ListProjects", "monitron:ListTagsForResource", "mq:Describe*", "mq:List*", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:ListTagsForResource", "network-firewall:ListTLSInspectionConfigurations", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectAttachment", "networkmanager:GetConnections", "networkmanager:GetConnectPeer", "networkmanager:GetConnectPeerAssociations", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkChangeEvents", "networkmanager:GetCoreNetworkChangeSet", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetNetworkResourceCounts", "networkmanager:GetNetworkResourceRelationships", "networkmanager:GetNetworkResources", "networkmanager:GetNetworkRoutes", "networkmanager:GetNetworkTelemetry", "networkmanager:GetResourcePolicy", "networkmanager:GetRouteAnalysis", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayConnectPeerAssociations", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:ListAttachments", "networkmanager:ListConnectPeers", "networkmanager:ListCoreNetworkPolicyVersions", "networkmanager:ListCoreNetworks", "networkmanager:ListPeerings", "networkmanager:ListTagsForResource", "nimble:GetEula", "nimble:GetFeatureMap", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileMember", "nimble:GetStreamingImage", "nimble:GetStreamingSession", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:GetStudioMember", "nimble:ListEulaAcceptances", "nimble:ListEulas", "nimble:ListLaunchProfileMembers", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStreamingSessions", "nimble:ListStudioComponents", "nimble:ListStudioMembers", "nimble:ListStudios", "nimble:ListTagsForResource", "notifications-contacts:GetEmailContact", "notifications-contacts:ListEmailContacts", "notifications-contacts:ListTagsForResource", "notifications:GetEventRule", "notifications:GetFeatureOptInStatus", "notifications:GetManagedNotificationChildEvent", "notifications:GetManagedNotificationConfiguration", "notifications:GetManagedNotificationEvent", "notifications:GetNotificationConfiguration", "notifications:GetNotificationsAccessForOrganization", "notifications:GetNotificationEvent", "notifications:List*", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "observabilityadmin:GetTelemetryEvaluationStatus", "observabilityadmin:GetTelemetryEvaluationStatusForOrganization", "observabilityadmin:ListResourceTelemetry", "observabilityadmin:ListResourceTelemetryForOrganization", "omics:Get*", "omics:List*", "one:GetDeviceConfigurationTemplate", "one:GetDeviceInstance", "one:GetDeviceInstanceConfiguration", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceConfigurationTemplates", "one:ListDeviceInstances", "one:ListSites", "one:ListUsers", "opsworks-cm:Describe*", "opsworks-cm:List*", "opsworks:Describe*", "opsworks:Get*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:GetPipelineBlueprint", "osis:GetPipelineChangeProgress", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource", "outposts:Get*", "outposts:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:GetPublicKeyCertificate", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:ListConnectors", "pca-connector-ad:ListDirectoryRegistrations", "pca-connector-ad:ListServicePrincipalNames", "pca-connector-ad:ListTagsForResource", "pca-connector-ad:ListTemplateGroupAccessControlEntries", "pca-connector-ad:ListTemplates", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:ListChallengeMetadata", "pca-connector-scep:ListConnectors", "pca-connector-scep:ListTagsForResource", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:Describe*", "personalize:Get*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "polly:Describe*", "polly:Get*", "polly:List*", "polly:SynthesizeSpeech", "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetPriceListFileUrl", "pricing:GetProducts", "pricing:ListPriceLists", "proton:GetDeployment", "proton:GetEnvironment", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateVersion", "proton:ListDeployments", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironments", "proton:ListEnvironmentTemplates", "proton:ListServiceInstances", "proton:ListServices", "proton:ListServiceTemplates", "proton:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ViewPurchaseOrders", "qbusiness:GetApplication", "qbusiness:GetChatControlsConfiguration", "qbusiness:GetDataSource", "qbusiness:GetGroup", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetUser", "qbusiness:GetWebExperience", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalKinesisStream", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "qldb:ListTagsForResource", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:ListRules", "rbin:ListTagsForResource", "rds:Describe*", "rds:Download*", "rds:List*", "redshift-serverless:GetCustomDomainAssociation", "redshift-serverless:GetEndpointAccess", "redshift-serverless:GetNamespace", "redshift-serverless:GetRecoveryPoint", "redshift-serverless:GetResourcePolicy", "redshift-serverless:GetScheduledAction", "redshift-serverless:GetSnapshot", "redshift-serverless:GetTableRestoreStatus", "redshift-serverless:GetUsageLimit", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListCustomDomainAssociations", "redshift-serverless:ListEndpointAccess", "redshift-serverless:ListNamespaces", "redshift-serverless:ListRecoveryPoints", "redshift-serverless:ListScheduledActions", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTableRestoreStatus", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListUsageLimits", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "redshift:GetReservedNodeExchangeOfferings", "redshift:ListRecommendations", "redshift:View*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetResourcePolicy", "refactor-spaces:GetRoute", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListEnvironmentVpcs", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "refactor-spaces:ListTagsForResource", "rekognition:CompareFaces", "rekognition:DescribeDataset", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DescribeStreamProcessor", "rekognition:Detect*", "rekognition:GetCelebrityInfo", "rekognition:GetCelebrityRecognition", "rekognition:GetContentModeration", "rekognition:GetFaceDetection", "rekognition:GetFaceSearch", "rekognition:GetLabelDetection", "rekognition:GetPersonTracking", "rekognition:GetSegmentDetection", "rekognition:GetTextDetection", "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", "resiliencehub:DescribeAppVersionAppComponent", "resiliencehub:DescribeAppVersionResource", "resiliencehub:DescribeAppVersionResourcesResolutionStatus", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeDraftAppVersionResourcesImportStatus", "resiliencehub:DescribeMetricsExport", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:DescribeResourceGroupingRecommendationTask", "resiliencehub:ListAlarmRecommendations", "resiliencehub:ListAppAssessmentComplianceDrifts", "resiliencehub:ListAppAssessmentResourceDrifts", "resiliencehub:ListAppAssessments", "resiliencehub:ListAppComponentCompliances", "resiliencehub:ListAppComponentRecommendations", "resiliencehub:ListAppInputSources", "resiliencehub:ListApps", "resiliencehub:ListAppVersionAppComponents", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", "resiliencehub:ListMetrics", "resiliencehub:ListRecommendationTemplates", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*", "robomaker:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:ListRoutingControls", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:List*", "route53domains:View*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "s3-object-lambda:GetObject", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectLegalHold", "s3-object-lambda:GetObjectRetention", "s3-object-lambda:GetObjectTagging", "s3-object-lambda:GetObjectVersion", "s3-object-lambda:GetObjectVersionAcl", "s3-object-lambda:GetObjectVersionTagging", "s3-object-lambda:ListBucket", "s3-object-lambda:ListBucketMultipartUploads", "s3-object-lambda:ListBucketVersions", "s3-object-lambda:ListMultipartUploadParts", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetBucketVersioning", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:GetObject", "s3-outposts:GetObjectTagging", "s3-outposts:GetObjectVersion", "s3-outposts:GetObjectVersionForReplication", "s3-outposts:GetObjectVersionTagging", "s3-outposts:GetReplicationConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListBucket", "s3-outposts:ListBucketMultipartUploads", "s3-outposts:ListBucketVersions", "s3-outposts:ListEndpoints", "s3-outposts:ListMultipartUploadParts", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListRegionalBuckets", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:Get*", "s3:List*", "sagemaker-groundtruth-synthetic:GetAccountDetails", "sagemaker-groundtruth-synthetic:GetBatch", "sagemaker-groundtruth-synthetic:GetProject", "sagemaker-groundtruth-synthetic:ListBatchDataTransfers", "sagemaker-groundtruth-synthetic:ListBatchSummaries", "sagemaker-groundtruth-synthetic:ListProjectDataTransfers", "sagemaker-groundtruth-synthetic:ListProjectSummaries", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search", "savingsplans:DescribeSavingsPlanRates", "savingsplans:DescribeSavingsPlans", "savingsplans:DescribeSavingsPlansOfferingRates", "savingsplans:DescribeSavingsPlansOfferings", "savingsplans:ListTagsForResource", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:Describe*", "schemas:Get*", "schemas:List*", "schemas:Search*", "sdb:Get*", "sdb:List*", "sdb:Select*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "securitylake:GetDataLakeExceptionSubscription", "securitylake:GetDataLakeOrganizationConfiguration", "securitylake:GetDataLakeSources", "securitylake:GetSubscriber", "securitylake:ListDataLakeExceptions", "securitylake:ListDataLakes", "securitylake:ListLogSources", "securitylake:ListSubscribers", "securitylake:ListTagsForResource", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:SearchApplications", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "servicediscovery:Get*", "servicediscovery:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "ses:BatchGetMetricData", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:Get*", "shield:List*", "signer:DescribeSigningJob", "signer:GetSigningPlatform", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningJobs", "signer:ListSigningPlatforms", "signer:ListSigningProfiles", "signer:ListTagsForResource", "signin:ListTrustedIdentityPropagationApplicationsForConsole", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeAccountLimits", "sms-voice:DescribeConfigurationSets", "sms-voice:DescribeKeywords", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DescribeOptOutLists", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribePools", "sms-voice:DescribeSenderIds", "sms-voice:DescribeSpendLimits", "sms-voice:ListPoolOriginationIdentities", "sms-voice:ListTagsForResource", "snowball:Describe*", "snowball:Get*", "snowball:List*", "sns:Check*", "sns:Get*", "sns:List*", "sqs:Get*", "sqs:List*", "sqs:Receive*", "ssm-contacts:DescribeEngagement", "ssm-contacts:DescribePage", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:ListContactChannels", "ssm-contacts:ListContacts", "ssm-contacts:ListEngagements", "ssm-contacts:ListPageReceipts", "ssm-contacts:ListPagesByContact", "ssm-contacts:ListPagesByEngagement", "ssm-incidents:GetIncidentRecord", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResourcePolicies", "ssm-incidents:GetResponsePlan", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListIncidentRecords", "ssm-incidents:ListRelatedItems", "ssm-incidents:ListReplicationSets", "ssm-incidents:ListResponsePlans", "ssm-incidents:ListTagsForResource", "ssm-incidents:ListTimelineEvents", "ssm-sap:GetApplication", "ssm-sap:GetComponent", "ssm-sap:GetDatabase", "ssm-sap:GetOperation", "ssm-sap:GetResourcePermission", "ssm-sap:ListApplications", "ssm-sap:ListComponents", "ssm-sap:ListDatabases", "ssm-sap:ListOperationEvents", "ssm-sap:ListOperations", "ssm-sap:ListTagsForResource", "ssm-quicksetup:GetConfiguration", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:GetServiceSettings", "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:ListTagsForResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Search*", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "states:Describe*", "states:GetExecutionHistory", "states:List*", "states:ValidateStateMachineDefinition", "storagegateway:Describe*", "storagegateway:List*", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity", "sts:GetSessionToken", "support:DescribeAttachment", "support:DescribeCaseAttributes", "support:DescribeCases", "support:DescribeCommunication", "support:DescribeCommunications", "support:DescribeCreateCaseOptions", "support:DescribeIssueTypes", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeSupportedLanguages", "support:DescribeSupportLevel", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:SearchForCases", "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:DescribeReportCreation", "tag:Get*", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "timestream:DescribeBatchLoadTask", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListBatchLoadTasks", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "tnb:GetSolFunctionInstance", "tnb:GetSolFunctionPackage", "tnb:GetSolFunctionPackageContent", "tnb:GetSolFunctionPackageDescriptor", "tnb:GetSolNetworkInstance", "tnb:GetSolNetworkOperation", "tnb:GetSolNetworkPackage", "tnb:GetSolNetworkPackageContent", "tnb:GetSolNetworkPackageDescriptor", "tnb:ListSolFunctionInstances", "tnb:ListSolFunctionPackages", "tnb:ListSolNetworkInstances", "tnb:ListSolNetworkOperations", "tnb:ListSolNetworkPackages", "tnb:ListTagsForResource", "transcribe:Get*", "transcribe:List*", "transfer:Describe*", "transfer:List*", "transfer:TestIdentityProvider", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:GetTerminology", "translate:ListParallelData", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "trustedadvisor:Describe*", "trustedadvisor:GetOrganizationRecommendation", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListOrganizationRecommendationAccounts", "trustedadvisor:ListOrganizationRecommendationResources", "trustedadvisor:ListOrganizationRecommendations", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "user-subscriptions:ListApplicationClaims", "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyStores", "verifiedpermissions:ListPolicyTemplates", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworkVpcAssociations", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:CheckCapacity", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wellarchitected:ExportLens", "wellarchitected:GetAnswer", "wellarchitected:GetConsolidatedReport", "wellarchitected:GetLens", "wellarchitected:GetLensReview", "wellarchitected:GetLensReviewReport", "wellarchitected:GetLensVersionDifference", "wellarchitected:GetMilestone", "wellarchitected:GetProfile", "wellarchitected:GetProfileTemplate", "wellarchitected:GetReviewTemplate", "wellarchitected:GetReviewTemplateAnswer", "wellarchitected:GetReviewTemplateLensReview", "wellarchitected:GetWorkload", "wellarchitected:List*", "workdocs:CheckAlias", "workdocs:Describe*", "workdocs:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStores", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListUserSettings", "workspaces:Describe*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:48.000Z", "lastUpdatedDate": "2025-01-23T12:37:06.000Z" }, "AWSCloudFormationReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:39:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate", "cloudformation:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-03T00:12:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:EstimateTemplateCost", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-02-06T22:16:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:EstimateTemplateCost", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudformation:DetectStackDrift", "cloudformation:DetectStackResourceDrift" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-11-13T17:40:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:EstimateTemplateCost", "cloudformation:Get*", "cloudformation:List*", "cloudformation:ValidateTemplate", "cloudformation:Detect*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:49.000Z", "lastUpdatedDate": "2019-11-13T17:40:07.000Z" }, "CloudFrontFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudFrontFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2015-02-06T18:39:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "cloudfront:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-05-04T17:52:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "cloudfront:*", "iam:ListServerCertificates" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2016-01-21T17:03:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "acm:ListCertificates", "cloudfront:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-02-19T19:52:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "acm:ListCertificates", "cloudfront:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-08-27T17:09:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "acm:ListCertificates", "cloudfront:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kinesis:ListStreams", "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "arn:aws:kinesis:::*" }, { "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "arn:aws:iam:::*" } ] } }, "v6": { "createdDate": "2020-09-03T20:18:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Action": [ "acm:ListCertificates", "cloudfront:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL", "kinesis:ListStreams" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "arn:aws:kinesis:*:*:*" }, { "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:*" } ] } }, "v7": { "createdDate": "2015-02-06T18:39:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "cfflistbuckets", "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Sid": "cffullaccess", "Action": [ "acm:ListCertificates", "cloudfront:*", "cloudfront-keyvaluestore:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL", "kinesis:ListStreams" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "cffdescribestream", "Action": [ "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "arn:aws:kinesis:*:*:*" }, { "Sid": "cfflistroles", "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:*" } ] } }, "v8": { "createdDate": "2015-02-06T18:39:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "cfflistbuckets", "Action": [ "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" }, { "Sid": "cffullaccess", "Action": [ "acm:ListCertificates", "cloudfront:*", "cloudfront-keyvaluestore:*", "iam:ListServerCertificates", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL", "kinesis:ListStreams", "ec2:DescribeInstances", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeInternetGateways" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "cffdescribestream", "Action": [ "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "arn:aws:kinesis:*:*:*" }, { "Sid": "cfflistroles", "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:*" } ] } } }, "createdDate": "2015-02-06T18:39:50.000Z", "lastUpdatedDate": "2024-11-20T18:39:41.000Z" }, "AWSCloudHSMFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudHSMFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:39:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudhsm:*", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:51.000Z", "lastUpdatedDate": "2015-02-06T18:39:51.000Z" }, "AWSCloudHSMReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudHSMReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:39:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudhsm:Get*", "cloudhsm:List*", "cloudhsm:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:52.000Z", "lastUpdatedDate": "2015-02-06T18:39:52.000Z" }, "ResourceGroupsandTagEditorFullAccess": { "arn": "arn:aws:iam::aws:policy/ResourceGroupsandTagEditorFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v2": { "createdDate": "2017-12-19T21:00:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:TagResources", "tag:UntagResources" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:39:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:addResourceTags", "tag:removeResourceTags" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-04-03T18:56:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:TagResources", "tag:UntagResources", "tag:AddResourceTags", "tag:RemoveResourceTags" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2019-10-02T23:57:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:TagResources", "tag:UntagResources", "resource-groups:*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-03-07T21:54:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:TagResources", "tag:UntagResources", "tag:AddResourceTags", "tag:RemoveResourceTags", "resource-groups:*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-08-10T13:29:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "tag:TagResources", "tag:UntagResources", "resource-groups:*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ListStacks" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:53.000Z", "lastUpdatedDate": "2023-08-10T13:29:19.000Z" }, "ResourceGroupsandTagEditorReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ResourceGroupsandTagEditorReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2019-03-07T19:43:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-08-10T13:42:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ListStacks" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:39:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:getResources", "tag:getTagKeys", "tag:getTagValues" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:54.000Z", "lastUpdatedDate": "2023-08-10T13:42:58.000Z" }, "CloudFrontReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudFrontReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2015-02-06T18:39:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudfront:Get*", "cloudfront:List*", "route53:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-05-04T17:56:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudfront:Get*", "cloudfront:List*", "iam:ListServerCertificates", "route53:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2016-01-21T17:03:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "cloudfront:Get*", "cloudfront:List*", "iam:ListServerCertificates", "route53:List*", "waf:ListWebACLs", "waf:GetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-02-19T19:49:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "cloudfront:Get*", "cloudfront:List*", "iam:ListServerCertificates", "route53:List*", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2021-09-08T22:10:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:ListCertificates", "cloudfront:DescribeFunction", "cloudfront:Get*", "cloudfront:List*", "iam:ListServerCertificates", "route53:List*", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2015-02-06T18:39:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "cfReadOnly", "Effect": "Allow", "Action": [ "acm:ListCertificates", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "iam:ListServerCertificates", "route53:List*", "waf:ListWebACLs", "waf:GetWebACL", "wafv2:ListWebACLs", "wafv2:GetWebACL" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:55.000Z", "lastUpdatedDate": "2024-01-04T16:55:27.000Z" }, "CloudSearchFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudSearchFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:39:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudsearch:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:56.000Z", "lastUpdatedDate": "2015-02-06T18:39:56.000Z" }, "CloudSearchReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudSearchReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:39:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudsearch:Describe*", "cloudsearch:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:39:57.000Z", "lastUpdatedDate": "2015-02-06T18:39:57.000Z" }, "CloudWatchFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:40:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:*", "logs:*", "sns:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-12-13T17:52:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:*", "logs:*", "sns:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-08-09T19:10:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:*", "logs:*", "sns:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-11-27T13:23:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudwatch:*", "logs:*", "sns:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "oam:ListSinks" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } } }, "createdDate": "2015-02-06T18:40:00.000Z", "lastUpdatedDate": "2022-11-27T13:23:49.000Z" }, "CloudWatchReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2015-02-06T18:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:Describe*", "logs:TestMetricFilter", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-02T20:50:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:Describe*", "logs:TestMetricFilter", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-05-10T21:40:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2022-11-27T13:08:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "oam:ListSinks", "sns:Get*", "sns:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v4": { "createdDate": "2020-07-17T17:49:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2023-06-06T17:33:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "oam:ListSinks", "sns:Get*", "sns:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v7": { "createdDate": "2015-02-06T18:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "oam:ListSinks", "sns:Get*", "sns:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v8": { "createdDate": "2015-02-06T18:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchReadOnlyAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "autoscaling:Describe*", "cloudwatch:BatchGet*", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "oam:ListSinks", "sns:Get*", "sns:List*", "rum:BatchGet*", "rum:Get*", "rum:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v9": { "createdDate": "2015-02-06T18:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchReadOnlyAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "application-signals:BatchGet*", "application-signals:Get*", "application-signals:List*", "autoscaling:Describe*", "cloudwatch:BatchGet*", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "oam:ListSinks", "sns:Get*", "sns:List*", "rum:BatchGet*", "rum:Get*", "rum:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "xray:BatchGet*", "xray:Get*" ], "Resource": "*" }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" }, { "Sid": "CloudWatchReadOnlyGetRolePermissions", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" } ] } }, "v10": { "createdDate": "2015-02-06T18:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchReadOnlyAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "application-signals:BatchGet*", "application-signals:Get*", "application-signals:List*", "autoscaling:Describe*", "cloudwatch:BatchGet*", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "oam:ListSinks", "sns:Get*", "sns:List*", "rum:BatchGet*", "rum:Get*", "rum:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "xray:BatchGet*", "xray:Get*", "xray:List*", "xray:StartTraceRetrieval", "xray:CancelTraceRetrieval" ], "Resource": "*" }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" }, { "Sid": "CloudWatchReadOnlyGetRolePermissions", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" } ] } } }, "createdDate": "2015-02-06T18:40:01.000Z", "lastUpdatedDate": "2024-11-21T17:51:05.000Z" }, "CloudWatchLogsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-02-06T18:40:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchLogsFullAccess", "Effect": "Allow", "Action": [ "logs:*", "cloudwatch:GenerateQuery" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:02.000Z", "lastUpdatedDate": "2023-11-26T18:12:09.000Z" }, "CloudWatchLogsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2015-02-06T18:40:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:Describe*", "logs:Get*", "logs:TestMetricFilter" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-12-03T19:59:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-08-14T22:22:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2023-06-06T17:16:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-01-14T19:32:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2015-02-06T18:40:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchLogsReadOnlyAccess", "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "cloudwatch:GenerateQuery" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:03.000Z", "lastUpdatedDate": "2023-11-26T18:11:33.000Z" }, "AWSDirectConnectFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:40:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-08-15T17:39:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:*", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-04-30T15:29:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:*", "ec2:DescribeVpnGateways", "ec2:DescribeTransitGateways" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:07.000Z", "lastUpdatedDate": "2019-04-30T15:29:29.000Z" }, "AWSDirectConnectReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:40:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:Describe*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-08-15T17:28:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:Describe*", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-04-30T15:23:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:Describe*", "ec2:DescribeVpnGateways", "ec2:DescribeTransitGateways" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-05-18T18:48:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:Describe*", "directconnect:List*", "ec2:DescribeVpnGateways", "ec2:DescribeTransitGateways" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:08.000Z", "lastUpdatedDate": "2020-05-18T18:48:22.000Z" }, "AmazonAppStreamFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAppStreamFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2015-02-06T18:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-09-10T17:29:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet", "Condition": { "StringLike": { "iam:AWSServiceName": "appstream.application-autoscaling.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2017-09-07T23:56:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2019-08-07T19:27:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet", "Condition": { "StringLike": { "iam:AWSServiceName": "appstream.application-autoscaling.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-07-09T21:54:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScheduledActions" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet", "Condition": { "StringLike": { "iam:AWSServiceName": "appstream.application-autoscaling.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2020-08-28T17:24:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:DeleteScheduledAction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet", "Condition": { "StringLike": { "iam:AWSServiceName": "appstream.application-autoscaling.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:40:09.000Z", "lastUpdatedDate": "2020-08-28T17:24:35.000Z" }, "AmazonAppStreamReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAppStreamReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-12-07T21:00:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "appstream:Get*", "appstream:List*", "appstream:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:10.000Z", "lastUpdatedDate": "2016-12-07T21:00:06.000Z" }, "AmazonDynamoDBFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2015-02-06T18:40:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-11-12T02:17:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-06-12T21:31:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2017-06-28T23:23:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2017-06-15T20:27:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2017-11-29T16:22:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication", "Condition": { "StringLike": { "iam:AWSServiceName": "replication.dynamodb.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2018-01-12T00:38:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2018-02-06T22:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2019-05-08T21:20:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2019-11-15T18:20:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2019-11-25T18:58:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2019-11-20T01:24:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2020-11-16T18:19:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com", "kinesisreplication.dynamodb.amazonaws.com" ] } } } ] } }, "v14": { "createdDate": "2020-12-11T20:27:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:GetMetricData", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com", "kinesisreplication.dynamodb.amazonaws.com" ] } } } ] } }, "v15": { "createdDate": "2021-01-29T17:38:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:*", "dax:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:GetMetricData", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes", "lambda:CreateFunction", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "resource-groups:DeleteGroup", "resource-groups:CreateGroup", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn", "dax.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.dynamodb.amazonaws.com", "dax.amazonaws.com", "dynamodb.application-autoscaling.amazonaws.com", "contributorinsights.dynamodb.amazonaws.com", "kinesisreplication.dynamodb.amazonaws.com" ] } } } ] } } }, "createdDate": "2015-02-06T18:40:11.000Z", "lastUpdatedDate": "2021-01-29T17:38:30.000Z" }, "AmazonDynamoDBReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2015-02-06T18:40:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-11-11T23:39:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-01-19T00:08:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListTagsOfResource", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2017-02-27T17:59:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListTagsOfResource", "dynamodb:DescribeTimeToLive", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2017-06-12T21:11:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListTagsOfResource", "dynamodb:DescribeTimeToLive", "dynamodb:DescribeLimits", "iam:GetRole", "iam:ListRoles", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2017-11-29T16:12:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListTagsOfResource", "dynamodb:DescribeTimeToLive", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeBackup", "dynamodb:ListBackups", "dynamodb:DescribeContinuousBackups", "iam:GetRole", "iam:ListRoles", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2018-01-09T19:46:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:ListTables", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListTagsOfResource", "dynamodb:DescribeTimeToLive", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeBackup", "dynamodb:ListBackups", "dynamodb:DescribeContinuousBackups", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2019-05-08T21:15:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2019-11-20T01:18:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v10": { "createdDate": "2019-11-25T19:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v11": { "createdDate": "2020-11-16T18:49:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v12": { "createdDate": "2020-12-11T20:17:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v13": { "createdDate": "2021-01-27T01:01:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:PartiQLSelect", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v14": { "createdDate": "2015-02-06T18:40:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralReadOnlyAccess", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetItem", "dynamodb:GetResourcePolicy", "dynamodb:Query", "dynamodb:Scan", "dynamodb:PartiQLSelect", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CCIAccess", "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } }, "v15": { "createdDate": "2015-02-06T18:40:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralReadOnlyAccess", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "dynamodb:BatchGetItem", "dynamodb:Describe*", "dynamodb:List*", "dynamodb:GetAbacStatus", "dynamodb:GetItem", "dynamodb:GetResourcePolicy", "dynamodb:Query", "dynamodb:Scan", "dynamodb:PartiQLSelect", "dax:Describe*", "dax:List*", "dax:GetItem", "dax:BatchGetItem", "dax:Query", "dax:Scan", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:GetFunctionConfiguration", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroup", "resource-groups:GetGroupQuery", "tag:GetResources", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CCIAccess", "Action": "cloudwatch:GetInsightRuleReport", "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" } ] } } }, "createdDate": "2015-02-06T18:40:12.000Z", "lastUpdatedDate": "2024-11-18T17:38:15.000Z" }, "AmazonDynamoDBFullAccesswithDataPipeline": { "arn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "dynamodb:*", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "*", "Sid": "DDBConsole" }, { "Action": [ "datapipeline:*", "iam:ListRoles" ], "Effect": "Allow", "Resource": "*", "Sid": "DDBConsoleImportExport" }, { "Effect": "Allow", "Action": [ "iam:GetRolePolicy", "iam:PassRole" ], "Resource": [ "*" ], "Sid": "IAMEDPRoles" }, { "Action": [ "ec2:CreateTags", "ec2:DescribeInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "datapipeline:*" ], "Effect": "Allow", "Resource": "*", "Sid": "EMR" }, { "Action": [ "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:Put*" ], "Effect": "Allow", "Resource": [ "*" ], "Sid": "S3" } ] } }, "v2": { "createdDate": "2015-11-12T02:17:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "dynamodb:*", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Effect": "Allow", "Resource": "*", "Sid": "DDBConsole" }, { "Action": [ "lambda:*", "iam:ListRoles" ], "Effect": "Allow", "Resource": "*", "Sid": "DDBConsoleTriggers" }, { "Action": [ "datapipeline:*", "iam:ListRoles" ], "Effect": "Allow", "Resource": "*", "Sid": "DDBConsoleImportExport" }, { "Effect": "Allow", "Action": [ "iam:GetRolePolicy", "iam:PassRole" ], "Resource": [ "*" ], "Sid": "IAMEDPRoles" }, { "Action": [ "ec2:CreateTags", "ec2:DescribeInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "datapipeline:*" ], "Effect": "Allow", "Resource": "*", "Sid": "EMR" }, { "Action": [ "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:Put*" ], "Effect": "Allow", "Resource": [ "*" ], "Sid": "S3" } ] } } }, "createdDate": "2015-02-06T18:40:14.000Z", "lastUpdatedDate": "2015-11-12T02:17:42.000Z" }, "AmazonEC2FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2017-10-30T22:35:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:*", "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spotfleet.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ec2scheduled.amazonaws.com/AWSServiceRoleForEC2Scheduled*", "Condition": { "StringLike": { "iam:AWSServiceName": "ec2scheduled.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-01-11T20:16:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:*", "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spotfleet.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ec2scheduled.amazonaws.com/AWSServiceRoleForEC2Scheduled*", "Condition": { "StringLike": { "iam:AWSServiceName": "ec2scheduled.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2015-02-06T18:40:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:*", "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-02-08T18:11:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:*", "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "ec2scheduled.amazonaws.com", "elasticloadbalancing.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2018-11-27T02:16:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:*", "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "ec2scheduled.amazonaws.com", "elasticloadbalancing.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "transitgateway.amazonaws.com" ] } } } ] } } }, "createdDate": "2015-02-06T18:40:15.000Z", "lastUpdatedDate": "2018-11-27T02:16:56.000Z" }, "AmazonEC2ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:40:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" } ] } }, "v3": { "createdDate": "2015-02-06T18:40:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:17.000Z", "lastUpdatedDate": "2024-12-27T10:07:06.000Z" }, "AmazonElastiCacheFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:40:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "elasticache:*", "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-12-07T17:48:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "elasticache:*", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticache.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2015-02-06T18:40:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElastiCacheManagementActions", "Effect": "Allow", "Action": "elasticache:*", "Resource": "*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticache.amazonaws.com" } } }, { "Sid": "CreateVPCEndpoints", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringLike": { "ec2:VpceServiceName": "com.amazonaws.elasticache.serverless.*" } } }, { "Sid": "AllowAccessToElastiCacheTaggedVpcEndpoints", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "NotResource": "arn:aws:ec2:*:*:vpc-endpoint/*" }, { "Sid": "TagVPCEndpointsOnCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/AmazonElastiCacheManaged": "true" } } }, { "Sid": "AllowAccessToEc2", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "AllowAccessToKMS", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Sid": "AllowAccessToCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "AllowAccessToAutoScaling", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScalingActivities" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ListLogDeliveryStreams", "Effect": "Allow", "Action": [ "firehose:ListDeliveryStreams" ], "Resource": "*" }, { "Sid": "DescribeS3Buckets", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AllowAccessToOutposts", "Effect": "Allow", "Action": [ "outposts:ListOutposts" ], "Resource": "*" }, { "Sid": "AllowAccessToSNS", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:20.000Z", "lastUpdatedDate": "2023-11-28T03:49:56.000Z" }, "AmazonElastiCacheReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElastiCacheReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticache:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:21.000Z", "lastUpdatedDate": "2015-02-06T18:40:21.000Z" }, "AmazonElasticMapReduceFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticMapReduceFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v2": { "createdDate": "2015-03-24T21:39:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:40:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:ListRoles", "iam:PassRole", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2015-05-21T17:13:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2015-12-21T23:20:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:CancelSpotInstanceRequests", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteRoute", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "ec2:DescribeNetworkAcls", "ec2:CreateVpcEndpoint", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2017-09-20T19:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:CancelSpotInstanceRequests", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteRoute", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "ec2:DescribeNetworkAcls", "ec2:CreateVpcEndpoint", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticmapreduce.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2018-01-23T19:40:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:CancelSpotInstanceRequests", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteRoute", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "ec2:DescribeNetworkAcls", "ec2:CreateVpcEndpoint", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*", "support:CreateCase", "support:DescribeServices", "support:DescribeSeverityLevels" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } } ] } }, "v7": { "createdDate": "2019-10-11T15:19:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:CancelSpotInstanceRequests", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteRoute", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "ec2:DescribeNetworkAcls", "ec2:CreateVpcEndpoint", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "elasticmapreduce:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "iam:PassRole", "kms:List*", "s3:*", "sdb:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } } ] } } }, "createdDate": "2015-02-06T18:40:22.000Z", "lastUpdatedDate": "2019-10-11T15:19:30.000Z" }, "AmazonElasticMapReduceReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticMapReduceReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:40:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:Describe*", "elasticmapreduce:List*", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:Select", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-05-22T23:00:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:ViewEventsFromAllClustersInConsole", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:Select", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-07-29T23:14:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ViewEventsFromAllClustersInConsole", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:Select", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:23.000Z", "lastUpdatedDate": "2020-07-29T23:14:09.000Z" }, "AmazonGlacierReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "glacier:ListVaults", "glacier:DescribeVault", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:DescribeJob", "glacier:GetJobOutput" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-05-05T18:46:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "glacier:DescribeJob", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetJobOutput", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:GetVaultNotifications", "glacier:ListJobs", "glacier:ListMultipartUploads", "glacier:ListParts", "glacier:ListTagsForVault", "glacier:ListVaults" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:27.000Z", "lastUpdatedDate": "2016-05-05T18:46:10.000Z" }, "AmazonGlacierFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonGlacierFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "glacier:*", "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:28.000Z", "lastUpdatedDate": "2015-02-06T18:40:28.000Z" }, "AmazonKinesisFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kinesis:*", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:29.000Z", "lastUpdatedDate": "2015-02-06T18:40:29.000Z" }, "AmazonKinesisReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesis:Get*", "kinesis:List*", "kinesis:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:30.000Z", "lastUpdatedDate": "2015-02-06T18:40:30.000Z" }, "AWSMarketplaceRead-only": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceRead-only", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2015-02-06T18:40:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:ViewSubscriptions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-07-31T23:24:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Resource": "*", "Action": [ "aws-marketplace:ViewSubscriptions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow" }, { "Resource": "*", "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:DescribeBuilds", "iam:ListRoles", "iam:ListInstanceProfiles", "sns:GetTopicAttributes", "sns:ListTopics" ] } ] } }, "v3": { "createdDate": "2019-10-28T21:51:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Resource": "*", "Action": [ "aws-marketplace:ViewSubscriptions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow" }, { "Resource": "*", "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:DescribeBuilds", "iam:ListRoles", "iam:ListInstanceProfiles", "sns:GetTopicAttributes", "sns:ListTopics" ] }, { "Resource": "*", "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ] } ] } }, "v4": { "createdDate": "2023-01-19T23:30:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Resource": "*", "Action": [ "aws-marketplace:ViewSubscriptions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow" }, { "Resource": "*", "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:DescribeBuilds", "iam:ListRoles", "iam:ListInstanceProfiles", "sns:GetTopicAttributes", "sns:ListTopics" ] }, { "Resource": "*", "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateListings" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2015-02-06T18:40:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:ListAgreementCharges", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:DescribeBuilds", "iam:ListRoles", "iam:ListInstanceProfiles", "sns:GetTopicAttributes", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateListings" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:31.000Z", "lastUpdatedDate": "2024-11-20T18:14:55.000Z" }, "AWSMarketplaceManageSubscriptions": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceManageSubscriptions", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:40:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-28T21:49:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "aws-marketplace:CreatePrivateMarketplaceRequests", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-01-19T23:45:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "aws-marketplace:CreatePrivateMarketplaceRequests", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateListings" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-02-06T18:40:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:CreatePrivateMarketplaceRequests", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListPrivateListings" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:UpdatePurchaseOrders", "aws-marketplace:ListAgreementCharges" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] }, "Null": { "aws-marketplace:AgreementType": "false" } } } ] } } }, "createdDate": "2015-02-06T18:40:32.000Z", "lastUpdatedDate": "2024-11-20T19:22:33.000Z" }, "AmazonMobileAnalyticsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMobileAnalyticsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mobileanalytics:*", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:34.000Z", "lastUpdatedDate": "2015-02-06T18:40:34.000Z" }, "AmazonMobileAnalyticsFinancialReportAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMobileAnalyticsFinancialReportAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mobileanalytics:GetReports", "mobileanalytics:GetFinancialReports" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:35.000Z", "lastUpdatedDate": "2015-02-06T18:40:35.000Z" }, "AmazonMobileAnalyticsNon-financialReportAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMobileAnalyticsNon-financialReportAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mobileanalytics:GetReports", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:36.000Z", "lastUpdatedDate": "2015-02-06T18:40:36.000Z" }, "AmazonMobileAnalyticsWriteOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMobileAnalyticsWriteOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mobileanalytics:PutEvents", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:37.000Z", "lastUpdatedDate": "2015-02-06T18:40:37.000Z" }, "IAMFullAccess": { "arn": "arn:aws:iam::aws:policy/IAMFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-21T19:40:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:*", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListChildren", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListPolicies", "organizations:ListTargetsForPolicy" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:38.000Z", "lastUpdatedDate": "2019-06-21T19:40:00.000Z" }, "IAMReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/IAMReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:40:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:List*", "iam:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-04-21T16:01:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:Get*", "iam:List*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-01-25T19:11:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-09-06T17:06:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:39.000Z", "lastUpdatedDate": "2018-01-25T19:11:27.000Z" }, "AWSKeyManagementServicePowerUser": { "arn": "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-03-07T00:55:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:TagResource", "kms:UntagResource", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:40.000Z", "lastUpdatedDate": "2017-03-07T00:55:11.000Z" }, "AmazonWorkMailFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkMailFullAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2015-02-06T18:40:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "ses:*", "workmail:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-04-20T08:35:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "ses:*", "workmail:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-03-24T18:12:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "ses:*", "workmail:*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-11-21T18:02:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "ses:*", "workmail:*" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2019-01-10T18:52:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-05-13T15:21:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:CreateDomain", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:ExtendDirectory", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeDomains", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*", "iam:ListRoles", "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "events.workmail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/events.workmail.amazonaws.com/AWSServiceRoleForAmazonWorkMailEvents*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*workmail*", "Condition": { "StringLike": { "iam:PassedToService": "events.workmail.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2019-10-21T13:12:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*", "iam:ListRoles", "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "events.workmail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/events.workmail.amazonaws.com/AWSServiceRoleForAmazonWorkMailEvents*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*workmail*", "Condition": { "StringLike": { "iam:PassedToService": "events.workmail.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2019-10-28T15:41:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:DeleteAlias", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*", "iam:ListRoles", "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "events.workmail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/events.workmail.amazonaws.com/AWSServiceRoleForAmazonWorkMailEvents*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*workmail*", "Condition": { "StringLike": { "iam:PassedToService": "events.workmail.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2019-12-09T11:52:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*", "iam:ListRoles", "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "events.workmail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/events.workmail.amazonaws.com/AWSServiceRoleForAmazonWorkMailEvents*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*workmail*", "Condition": { "StringLike": { "iam:PassedToService": "events.workmail.amazonaws.com" } } } ] } }, "v10": { "createdDate": "2020-12-21T14:13:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:CheckAlias", "ds:CreateAlias", "ds:CreateDirectory", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "route53:ChangeResourceRecordSets", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53:GetHostedZone", "route53domains:CheckDomainAvailability", "route53domains:ListDomains", "ses:*", "workmail:*", "iam:ListRoles", "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "events.workmail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/events.workmail.amazonaws.com/AWSServiceRoleForAmazonWorkMailEvents*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*workmail*", "Condition": { "StringLike": { "iam:PassedToService": "events.workmail.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:40:41.000Z", "lastUpdatedDate": "2020-12-21T14:13:40.000Z" }, "AmazonWorkMailReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkMailReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:40:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:Describe*", "ses:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-05-13T15:12:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:Describe*", "ses:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "lambda:ListFunctions", "iam:ListRoles", "logs:DescribeLogGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-12-04T13:40:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:Describe*", "ses:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "lambda:ListFunctions" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-07-25T08:24:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:Describe*", "ses:Get*", "workmail:Describe*", "workmail:Get*", "workmail:List*", "workmail:Search*", "lambda:ListFunctions", "iam:ListRoles", "logs:DescribeLogGroups", "cloudwatch:GetMetricData" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:42.000Z", "lastUpdatedDate": "2019-07-25T08:24:50.000Z" }, "AWSImportExportReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSImportExportReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "importexport:ListJobs", "importexport:GetStatus" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:42.000Z", "lastUpdatedDate": "2015-02-06T18:40:42.000Z" }, "AWSImportExportFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSImportExportFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "importexport:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:43.000Z", "lastUpdatedDate": "2015-02-06T18:40:43.000Z" }, "AWSLambdaExecute": { "arn": "arn:aws:iam::aws:policy/AWSLambdaExecute", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:*" ], "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::*" } ] } } }, "createdDate": "2015-02-06T18:40:46.000Z", "lastUpdatedDate": "2015-02-06T18:40:46.000Z" }, "AWSLambdaInvocation-DynamoDB": { "arn": "arn:aws:iam::aws:policy/AWSLambdaInvocation-DynamoDB", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListStreams" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:47.000Z", "lastUpdatedDate": "2015-02-06T18:40:47.000Z" }, "AmazonRedshiftFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2015-02-06T18:40:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:CreateTopic", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "cloudwatch:EnableAlarmActions", "cloudwatch:DisableAlarmActions" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-09-19T18:27:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:CreateTopic", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "cloudwatch:EnableAlarmActions", "cloudwatch:DisableAlarmActions" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-07-07T23:31:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:*", "redshift-serverless:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:CreateTopic", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "cloudwatch:EnableAlarmActions", "cloudwatch:DisableAlarmActions", "tag:GetResources", "tag:UntagResources", "tag:GetTagValues", "tag:GetTagKeys", "tag:TagResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift.amazonaws.com" } } }, { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerListPermissions", "Action": [ "secretsmanager:ListSecrets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerCreateGetPermissions", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } } ] } }, "v4": { "createdDate": "2020-09-09T19:51:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:CreateTopic", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "cloudwatch:EnableAlarmActions", "cloudwatch:DisableAlarmActions", "tag:GetResources", "tag:UntagResources", "tag:GetTagValues", "tag:GetTagKeys", "tag:TagResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift.amazonaws.com" } } }, { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerListPermissions", "Action": [ "secretsmanager:ListSecrets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerCreateGetPermissions", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } } ] } }, "v3": { "createdDate": "2019-08-06T00:05:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:CreateTopic", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "cloudwatch:EnableAlarmActions", "cloudwatch:DisableAlarmActions", "cloudwatch:ListMetrics", "cloudwatch:GetMetricWidgetImage", "cloudwatch:GetMetricData", "tag:GetResources", "tag:UntagResources", "tag:GetTagValues", "tag:GetTagKeys", "tag:TagResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:40:50.000Z", "lastUpdatedDate": "2022-07-07T23:31:13.000Z" }, "AmazonRedshiftReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:Describe*", "redshift:ViewQueriesInConsole", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:List*", "cloudwatch:Get*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-02-06T18:40:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRedshiftReadOnlyAccess", "Action": [ "redshift:Describe*", "redshift:ListRecommendations", "redshift:ViewQueriesInConsole", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "sns:Get*", "sns:List*", "cloudwatch:Describe*", "cloudwatch:List*", "cloudwatch:Get*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:51.000Z", "lastUpdatedDate": "2024-02-08T00:24:13.000Z" }, "AmazonRDSFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2015-02-06T18:40:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-12-16T21:02:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2017-09-14T23:40:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" } ] } }, "v3": { "createdDate": "2017-08-28T21:35:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2017-11-20T18:36:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2020-08-27T23:38:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2018-04-09T17:42:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2022-03-07T21:11:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2020-11-24T19:30:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": "pi:*", "Effect": "Allow", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2022-12-19T20:09:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Effect": "Allow", "Action": "pi:*", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2023-03-15T13:44:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Effect": "Allow", "Action": "pi:*", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2023-03-30T12:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Effect": "Allow", "Action": "pi:*", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } }, { "Action": [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "devops-guru:ServiceNames": [ "RDS" ] }, "Null": { "devops-guru:ServiceNames": "false" } } } ] } }, "v13": { "createdDate": "2023-04-14T12:27:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Effect": "Allow", "Action": "pi:*", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } }, { "Action": [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "devops-guru:ServiceNames": [ "RDS" ] }, "Null": { "devops-guru:ServiceNames": "false" } } } ] } }, "v14": { "createdDate": "2015-02-06T18:40:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Effect": "Allow", "Action": "pi:*", "Resource": [ "arn:aws:pi:*:*:metrics/rds/*", "arn:aws:pi:*:*:perf-reports/rds/*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } }, { "Action": [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "devops-guru:ServiceNames": [ "RDS" ] }, "Null": { "devops-guru:ServiceNames": "false" } } } ] } } }, "createdDate": "2015-02-06T18:40:52.000Z", "lastUpdatedDate": "2023-08-17T23:00:17.000Z" }, "AmazonRDSReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2015-02-06T18:40:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-12-16T20:58:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2022-12-19T20:44:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "logs:DescribeLogStreams", "logs:GetLogEvents", "devops-guru:GetResourceCollection" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-08-28T21:36:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2023-03-15T14:02:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "logs:DescribeLogStreams", "logs:GetLogEvents", "devops-guru:GetResourceCollection" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-03-30T14:42:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "logs:DescribeLogStreams", "logs:GetLogEvents", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Action": [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "devops-guru:ServiceNames": [ "RDS" ] }, "Null": { "devops-guru:ServiceNames": "false" } } } ] } }, "v7": { "createdDate": "2023-04-14T12:32:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:Describe*", "rds:ListTagsForResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "logs:DescribeLogStreams", "logs:GetLogEvents", "devops-guru:GetResourceCollection" ], "Resource": "*" }, { "Action": [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "devops-guru:ServiceNames": [ "RDS" ] }, "Null": { "devops-guru:ServiceNames": "false" } } } ] } } }, "createdDate": "2015-02-06T18:40:53.000Z", "lastUpdatedDate": "2023-04-14T12:32:09.000Z" }, "AmazonRoute53FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53FullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2017-02-14T21:25:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticbeanstalk:DescribeEnvironments", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsiteConfiguration", "ec2:DescribeVpcs", "ec2:DescribeRegions", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:40:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2018-12-20T21:42:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticbeanstalk:DescribeEnvironments", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRegions", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": "arn:aws:apigateway:*::/domainnames" } ] } }, "v3": { "createdDate": "2017-11-13T22:22:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticbeanstalk:DescribeEnvironments", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite", "ec2:DescribeVpcs", "ec2:DescribeRegions", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:54.000Z", "lastUpdatedDate": "2018-12-20T21:42:00.000Z" }, "AmazonRoute53ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53ReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:Get*", "route53:List*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2016-11-15T21:15:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:Get*", "route53:List*", "route53:TestDNSAnswer" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:40:55.000Z", "lastUpdatedDate": "2016-11-15T21:15:16.000Z" }, "AmazonRoute53DomainsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53DomainsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:CreateHostedZone", "route53domains:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:40:56.000Z", "lastUpdatedDate": "2015-02-06T18:40:56.000Z" }, "AmazonRoute53DomainsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53DomainsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:40:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53domains:Get*", "route53domains:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:40:57.000Z", "lastUpdatedDate": "2015-02-06T18:40:57.000Z" }, "AmazonS3FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3FullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:40:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2021-09-27T20:16:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*", "s3-object-lambda:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:58.000Z", "lastUpdatedDate": "2021-09-27T20:16:37.000Z" }, "AmazonS3ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2021-09-27T20:24:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*", "s3-object-lambda:Get*", "s3-object-lambda:List*" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-02-06T18:40:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-08-10T21:31:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*", "s3:Describe*", "s3-object-lambda:Get*", "s3-object-lambda:List*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:40:59.000Z", "lastUpdatedDate": "2023-08-10T21:31:39.000Z" }, "SecurityAudit": { "arn": "arn:aws:iam::aws:policy/SecurityAudit", "latestVersionId": "v50", "versionsCount": 50, "versions": { "v1": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudwatch:Describe*", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "elasticbeanstalk:Describe*", "elasticache:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "glacier:ListVaults", "iam:Get*", "iam:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListResourceRecordSets", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-04-21T16:44:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudwatch:Describe*", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticbeanstalk:Describe*", "elasticache:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListResourceRecordSets", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2015-06-15T22:13:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudwatch:Describe*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2016-07-28T17:01:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "cloudwatchlogs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions ", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2015-12-14T17:19:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2016-08-25T20:26:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "cloudwatchlogs:describeLogGroups", "cloudwatchlogs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions ", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2016-09-20T19:41:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "cloudwatchlogs:describeLogGroups", "cloudwatchlogs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "firehose:Describe*", "firehose:List*", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2016-11-10T20:06:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "cloudwatchlogs:describeLogGroups", "cloudwatchlogs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2016-12-09T18:51:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "logs:describeLogGroups", "logs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocations", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v10": { "createdDate": "2017-03-23T18:50:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "logs:describeLogGroups", "logs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocation", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v11": { "createdDate": "2017-05-31T21:34:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:getStackPolicy", "logs:describeLogGroups", "logs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocation", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v12": { "createdDate": "2017-07-12T20:16:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "cloudformation:getStackPolicy", "logs:describeLogGroups", "logs:describeMetricFilters", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocation", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetInventoryConfiguration", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v13": { "createdDate": "2017-10-11T18:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "cloudformation:getStackPolicy", "logs:describeLogGroups", "logs:describeMetricFilters", "logs:DescribeResourcePolicies", "autoscaling:Describe*", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "dynamodb:ListTables", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:ListDomainNames", "es:Describe*", "firehose:Describe*", "firehose:List*", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:GetChange", "route53:GetCheckerIpRanges", "route53:GetGeoLocation", "route53:GetHealthCheck", "route53:GetHealthCheckCount", "route53:GetHealthCheckLastFailureReason", "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:GetReusableDelegationSet", "route53:ListGeoLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListReusableDelegationSets", "route53:ListTagsForResource", "route53:ListTagsForResources", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetBucket*", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetInventoryConfiguration", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration", "s3:GetLifecycleConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "tag:GetResources", "tag:GetTagKeys" ], "Effect": "Allow", "Resource": "*" } ] } }, "v14": { "createdDate": "2018-01-03T17:58:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "machinelearning:DescribeMLModels", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs" ] } ] } }, "v15": { "createdDate": "2018-01-17T18:46:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:DescribeDocumentPermission", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs" ] } ] } }, "v16": { "createdDate": "2018-02-05T21:51:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:DescribeDocumentPermission", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs" ] } ] } }, "v17": { "createdDate": "2018-03-12T20:01:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:DescribeDocumentPermission", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs" ] } ] } }, "v18": { "createdDate": "2018-05-01T20:06:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:DescribeDocumentPermission", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v19": { "createdDate": "2018-05-15T18:30:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:DescribeDocumentPermission", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v20": { "createdDate": "2018-07-30T18:30:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:GetAccountAuthorizationDetails", "iam:GetContextKeysForCustomPolicy", "iam:GetContextKeysForPrincipalPolicy", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v21": { "createdDate": "2018-09-10T22:49:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:GetAccountAuthorizationDetails", "iam:GetContextKeysForCustomPolicy", "iam:GetContextKeysForPrincipalPolicy", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v22": { "createdDate": "2018-09-17T20:33:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "directconnect:Describe*", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:GetAccountAuthorizationDetails", "iam:GetContextKeysForCustomPolicy", "iam:GetContextKeysForPrincipalPolicy", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v23": { "createdDate": "2018-10-16T20:29:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:GetAccountAuthorizationDetails", "iam:GetContextKeysForCustomPolicy", "iam:GetContextKeysForPrincipalPolicy", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] } ] } }, "v24": { "createdDate": "2018-11-05T19:03:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "application-autoscaling:Describe*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:GetAccountAuthorizationDetails", "iam:GetContextKeysForCustomPolicy", "iam:GetContextKeysForPrincipalPolicy", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:DescribeEndpoint", "iot:ListThings", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:ListFunctions", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:ListApplications", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:HEAD", "apigateway:GET", "apigateway:OPTIONS" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v27": { "createdDate": "2019-04-29T18:33:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetPublicAccessBlock", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:HEAD", "apigateway:GET", "apigateway:OPTIONS" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v25": { "createdDate": "2019-01-11T01:51:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:DescribeEventBus", "events:ListRules", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iot:Describe*", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetPublicAccessBlock", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:HEAD", "apigateway:GET", "apigateway:OPTIONS" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v26": { "createdDate": "2019-03-22T16:38:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:Deliver*", "config:Describe*", "config:Get*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetPublicAccessBlock", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "ssm:Describe*", "ssm:ListDocuments", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:HEAD", "apigateway:GET", "apigateway:OPTIONS" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v31": { "createdDate": "2019-10-15T21:02:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v28": { "createdDate": "2019-06-06T18:09:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v30": { "createdDate": "2019-08-16T10:06:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v29": { "createdDate": "2019-07-18T20:16:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v32": { "createdDate": "2020-02-25T16:08:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v33": { "createdDate": "2020-09-28T18:51:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:ListWebACLs", "waf-regional:ListWebACLs", "workspaces:Describe*", "cloudsearch:DescribeDomainEndpointOptions", "cloudwatch:ListTagsForResource", "detective:ListGraphs", "detective:ListMembers", "dynamodb:ListTagsOfResource", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "eks:DescribeNodeGroup", "eks:ListNodeGroups", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:ListTagsForResource", "elasticmapreduce:GetBlockPublicAccessConfiguration", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:TestEventPattern", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "guardduty:DescribePublishingDestination", "secretsmanager:DescribeSecret", "ssm:ListTagsForResource" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v34": { "createdDate": "2020-12-15T00:04:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudformation:GetStackPolicy", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticbeanstalk:Describe*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:Describe*", "es:ListDomainNames", "events:Describe*", "events:List*", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "greengrass:List*", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "opsworks:DescribeStacks", "opsworks-cm:DescribeServers", "organizations:List*", "organizations:Describe*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:List*", "route53resolver:Get*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListDocuments", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf:GetWebACL", "waf:ListWebACLs", "waf:ListTagsForResource", "wafv2:GetWebACL", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "workspaces:Describe*", "cloudsearch:DescribeDomainEndpointOptions", "cloudwatch:ListTagsForResource", "detective:ListGraphs", "detective:ListMembers", "detective:GetGraphIngestState", "dynamodb:ListTagsOfResource", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ecr:DescribeImages", "ecr:GetLifecyclePolicy", "ecr:ListTagsForResource", "eks:DescribeNodeGroup", "eks:ListNodeGroups", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:ListTagsForResource", "elasticmapreduce:GetBlockPublicAccessConfiguration", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:TestEventPattern", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "guardduty:DescribePublishingDestination", "secretsmanager:DescribeSecret", "sns:ListTagsForResource", "ssm:ListTagsForResource" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v36": { "createdDate": "2022-10-06T19:49:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:ListTagsForResource", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListNodeGroups", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticloadbalancing:Describe*", "es:Describe*", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:GetFindingsReportStatus", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kafka:Describe*", "kafka:List*", "kafka-cluster:Describe*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:ListBots", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mediaconnect:Describe*", "mediaconnect:List*", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:ListFirewalls", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v37": { "createdDate": "2022-11-19T01:02:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "application-autoscaling:Describe*", "appmesh:Describe*", "appsync:GetApiCache", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:ListTagsForResource", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListNodeGroups", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticloadbalancing:Describe*", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:GetFindingsReportStatus", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListGateways", "kafka:Describe*", "kafka:List*", "kafka-cluster:Describe*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:ListBots", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:ListFirewalls", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionsPolicies", "sso:DescribePermissionSet", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v35": { "createdDate": "2021-04-14T20:28:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm-pca:ListPermissions", "acm:Describe*", "acm:List*", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:ListTagsForResource", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:ListIdentityPools", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListNodeGroups", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "es:Describe*", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "license-manager:List*", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "machinelearning:DescribeMLModels", "mediaconnect:Describe*", "mediaconnect:List*", "mediastore:GetContainerPolicy", "mediastore:ListContainers", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:ListFirewalls", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribePermissionsPolicies", "sso:List*", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "tag:GetResources", "tag:GetTagKeys", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v38": { "createdDate": "2023-06-07T18:56:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Sid": "BaseSecurityAuditStatement", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:ListInstances", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfigurations", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedEntities", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEvents", "health:DescribeEventTypes", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccountSendingEnabled", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:GetWebACLforResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v39": { "createdDate": "2023-07-20T19:34:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Sid": "BaseSecurityAuditStatement", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListTagsForResource", "cloudwatch:ListDashboards", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "connect:ListInstances", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfigurations", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedEntities", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEvents", "health:DescribeEventTypes", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccountSendingEnabled", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:GetWebACLforResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v40": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Sid": "BaseSecurityAuditStatement", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListTagsForResource", "cloudwatch:ListDashboards", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListInstances", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfigurations", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedEntities", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEvents", "health:DescribeEventTypes", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccountSendingEnabled", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:GetWebACLforResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v41": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Sid": "BaseSecurityAuditStatement", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupVaults", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListTagsForResource", "cloudwatch:ListDashboards", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListInstances", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfigurations", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedEntities", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEvents", "health:DescribeEventTypes", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListIndices", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "machinelearning:DescribeMLModels", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccountSendingEnabled", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetWebACL", "wafv2:GetWebACLforResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ] }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v42": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstanceStorageConfigs", "connect:ListInstances", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEventTypes", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v43": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstanceStorageConfigs", "connect:ListInstances", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEventTypes", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDataSources", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v44": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstanceStorageConfigs", "connect:ListInstances", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEventTypes", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDataSources", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v45": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstanceStorageConfigs", "connect:ListInstances", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImageTags", "ecr-public:DescribeImages", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEventTypes", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDiskSnapshots", "lightsail:GetDisks", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:ListEnvironments", "m2:ListApplications", "m2:GetEnvironment", "m2:GetApplication", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDataSources", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemaVersions", "schemas:ListSchemas", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociationVersions", "ssm:ListAssociations", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocumentVersions", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorChecks", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v46": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeEventTypes", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v47": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codebuild:ListSourceCredentials", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeEventTypes", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v48": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codebuild:ListSourceCredentials", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "entityresolution:GetIdNamespace", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeEventTypes", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v49": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codebuild:ListSourceCredentials", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "entityresolution:GetIdNamespace", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeEventTypes", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v50": { "createdDate": "2015-02-06T18:41:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseSecurityAuditStatement", "Effect": "Allow", "Action": [ "a4b:ListSkills", "access-analyzer:GetAnalyzedResource", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:GetFinding", "access-analyzer:ListAnalyzedResources", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListFindings", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "account:GetPrimaryEmail", "account:GetRegionOptStatus", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetPolicy", "acm-pca:ListCertificateAuthorities", "acm-pca:ListPermissions", "acm-pca:ListTags", "acm:Describe*", "acm:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:Describe*", "appmesh:Describe*", "appmesh:List*", "apprunner:DescribeAutoScalingConfiguration", "apprunner:DescribeCustomDomains", "apprunner:DescribeObservabilityConfiguration", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:DescribeVpcIngressConnection", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListObservabilityConfigurations", "apprunner:ListOperations", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "apprunner:ListVpcIngressConnections", "appsync:GetApiCache", "appsync:List*", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAccountStatus", "auditmanager:ListAssessmentControlInsightsByControlDomain", "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessmentFrameworkShareRequests", "auditmanager:ListAssessmentReports", "auditmanager:ListAssessments", "auditmanager:ListControlDomainInsights", "auditmanager:ListControlDomainInsightsByAssessment", "auditmanager:ListControlInsightsByControlDomain", "auditmanager:ListControls", "auditmanager:ListNotifications", "auditmanager:ListTagsForResource", "autoscaling-plans:DescribeScalingPlans", "autoscaling:Describe*", "backup:DescribeGlobalSettings", "backup:DescribeRegionSettings", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupVaults", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobDefinitions", "bedrock:GetCustomModel", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaborationConfiguredAudienceModelAssociation", "cleanrooms:GetCollaborationIdNamespaceAssociation", "cleanrooms:GetCollaborationPrivacyBudgetTemplate", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetConfiguredTableAssociationAnalysisRule", "cleanrooms:GetIdMappingTable", "cleanrooms:GetIdNamespaceAssociation", "cleanrooms:GetMembership", "cleanrooms:GetPrivacyBudgetTemplate", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborationIdNamespaceAssociations", "cleanrooms:ListCollaborationPrivacyBudgetTemplates", "cleanrooms:ListCollaborationPrivacyBudgets", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredAudienceModelAssociations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListIdMappingTables", "cleanrooms:ListIdNamespaceAssociations", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListPrivacyBudgetTemplates", "cleanrooms:ListPrivacyBudgets", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource", "cleanrooms:PreviewPrivacyImpact", "cloud9:Describe*", "cloud9:ListEnvironments", "clouddirectory:ListDirectories", "cloudformation:DescribeStack*", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStack*", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:DescribeDomainEndpointOptions", "cloudsearch:DescribeDomains", "cloudsearch:DescribeServiceAccessPolicies", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:GetDashboard", "cloudwatch:ListDashboards", "cloudwatch:ListTagsForResource", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codebuild:BatchGetProjects", "codebuild:GetResourcePolicy", "codebuild:ListProjects", "codebuild:ListSourceCredentials", "codecommit:BatchGetRepositories", "codecommit:GetBranch", "codecommit:GetObjectIdentifier", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:GetJobDetails", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codestar:Describe*", "codestar:List*", "cognito-identity:Describe*", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:Describe*", "cognito-idp:ListDevices", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserImportJobs", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-sync:Describe*", "cognito-sync:List*", "comprehend:Describe*", "comprehend:List*", "comprehendmedical:ListICD10CMInferenceJobs", "comprehendmedical:ListPHIDetectionJobs", "comprehendmedical:ListRxNormInferenceJobs", "comprehendmedical:ListSNOMEDCTInferenceJobs", "config:BatchGetAggregateResourceConfig", "config:BatchGetResourceConfig", "config:Deliver*", "config:Describe*", "config:Get*", "config:List*", "config:SelectAggregateResourceConfig", "config:SelectResourceConfig", "connect:ListApprovedOrigins", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListLexBots", "connect:ListSecurityKeys", "databrew:DescribeDataset", "databrew:DescribeProject", "databrew:ListJobs", "databrew:ListProjects", "dataexchange:ListDataSets", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:EvaluateExpression", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ValidatePipelineDefinition", "datasync:Describe*", "datasync:List*", "dax:Describe*", "dax:ListTags", "deepracer:ListModels", "detective:GetGraphIngestState", "detective:ListGraphs", "detective:ListMembers", "devicefarm:ListProjects", "directconnect:Describe*", "discovery:DescribeAgents", "discovery:DescribeConfigurations", "discovery:DescribeContinuousExports", "discovery:DescribeExportConfigurations", "discovery:DescribeExportTasks", "discovery:DescribeImportTasks", "dms:Describe*", "dms:ListTagsForResource", "docdb-elastic:ListClusters", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:GetImageBlockPublicAccessState", "ec2:GetManagedPrefixListAssociations", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayPrefixListReferences", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:DescribeRegistries", "ecr-public:DescribeRepositories", "ecr-public:GetRegistryCatalogData", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodeGroups", "eks:ListTagsForResource", "eks:ListUpdates", "elastic-inference:DescribeAccelerators", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Describe*", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elastictranscoder:ListPipelines", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "emr-serverless:ListJobRuns", "entityresolution:GetIdNamespace", "es:Describe*", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListElasticsearchInstanceTypeDetails", "es:ListElasticsearchVersions", "es:ListTags", "events:Describe*", "events:List*", "events:TestEventPattern", "finspace:ListEnvironments", "finspace:ListKxEnvironments", "firehose:Describe*", "firehose:List*", "fms:ListComplianceStatus", "fms:ListPolicies", "forecast:ListDatasets", "frauddetector:GetDetectors", "fsx:Describe*", "fsx:List*", "gamelift:ListBuilds", "gamelift:ListFleets", "geo:ListMaps", "glacier:DescribeVault", "glacier:GetDataRetrievalPolicy", "glacier:GetVaultAccessPolicy", "glacier:GetVaultLock", "glacier:ListVaults", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetDataCatalogEncryptionSettings", "glue:GetDevEndpoints", "glue:GetJobs", "glue:GetResourcePolicy", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "grafana:ListWorkspaces", "greengrass:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "health:DescribeAffectedAccountsForOrganization", "health:DescribeAffectedEntities", "health:DescribeAffectedEntitiesForOrganization", "health:DescribeEntityAggregates", "health:DescribeEventAggregates", "health:DescribeEventDetails", "health:DescribeEventDetailsForOrganization", "health:DescribeEvents", "health:DescribeEventsForOrganization", "health:DescribeEventTypes", "health:DescribeHealthServiceStatusForOrganization", "healthlake:ListFHIRDatastores", "honeycode:ListTables", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "identitystore:ListUsers", "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFilters", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "iot:Describe*", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:List*", "iotanalytics:ListChannels", "iotevents:ListInputs", "iotfleetwise:ListModelManifests", "iotsitewise:DescribeGatewayCapabilityConfiguration", "iotsitewise:ListAssetModels", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:GetBootstrapBrokers", "kafka:GetCompatibleKafkaVersions", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:DescribeIndex", "kendra:ListDataSources", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeLimits", "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeEdgeConfiguration", "kinesisvideo:DescribeMappedResourceConfiguration", "kinesisvideo:DescribeMediaStorageConfiguration", "kinesisvideo:DescribeNotificationConfiguration", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:GetAccountSettings", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:List*", "lex:DescribeBot", "lex:DescribeResourcePolicy", "lex:ListBots", "license-manager:List*", "lightsail:GetBuckets", "lightsail:GetContainerServices", "lightsail:GetDisks", "lightsail:GetDiskSnapshots", "lightsail:GetInstances", "lightsail:GetLoadBalancers", "logs:Describe*", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "lookoutequipment:ListDatasets", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:DescribeMLModels", "macie2:ListFindings", "managedblockchain:ListNetworks", "mechanicalturk:ListHITs", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:ListChannels", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage:DescribeOriginEndpoint", "mediapackage:ListOriginEndpoints", "mediastore:GetContainerPolicy", "mediastore:GetCorsPolicy", "mediastore:ListContainers", "memorydb:DescribeClusters", "mq:DescribeBroker", "mq:DescribeBrokerEngineTypes", "mq:DescribeBrokerInstanceOptions", "mq:DescribeConfiguration", "mq:DescribeConfigurationRevision", "mq:DescribeUser", "mq:ListBrokers", "mq:ListConfigurationRevisions", "mq:ListConfigurations", "mq:ListTags", "mq:ListUsers", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "networkmanager:DescribeGlobalNetworks", "nimble:ListStudios", "opsworks-cm:DescribeServers", "opsworks:DescribeStacks", "organizations:Describe*", "organizations:List*", "pcs:GetCluster", "pcs:GetComputeNodeGroup", "pcs:GetQueue", "pcs:ListClusters", "pcs:ListComputeNodeGroups", "pcs:ListQueues", "pcs:ListTagsForResource", "personalize:DescribeDatasetGroup", "personalize:ListDatasetGroups", "private-networks:ListNetworks", "profile:GetDomain", "profile:ListDomains", "profile:ListIntegrations", "qbusiness:ListApplications", "qbusiness:ListDataSources", "qbusiness:ListDataSourceSyncJobs", "qbusiness:ListDocuments", "qbusiness:ListGroups", "qbusiness:ListIndices", "qbusiness:ListPlugins", "qbusiness:ListRetrievers", "qbusiness:ListSubscriptions", "qbusiness:ListTagsForResource", "qbusiness:ListWebExperiences", "qldb:DescribeJournalS3Export", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:ListLedgers", "quicksight:Describe*", "quicksight:List*", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:Describe*", "rekognition:Describe*", "rekognition:List*", "resource-groups:ListGroupResources", "robomaker:Describe*", "robomaker:List*", "route53:Get*", "route53:List*", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:ListDomains", "route53domains:ListOperations", "route53domains:ListTagsForDomain", "route53resolver:Get*", "route53resolver:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3-outposts:ListSharedEndpoints", "s3:DescribeJob", "s3:GetAccelerateConfiguration", "s3:GetAccessGrantsInstanceResourcePolicy", "s3:GetAccessPoint", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetAnalyticsConfiguration", "s3:GetBucket*", "s3:GetEncryptionConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetObjectAcl", "s3:GetObjectVersionAcl", "s3:GetReplicationConfiguration", "s3:GetStorageLensGroup", "s3:GetStorageLensConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListStorageLensGroups", "s3:ListJobs", "s3:ListCallerAccessGrants", "s3:ListAccessGrantsInstances", "s3:ListAccessGrants", "s3:ListStorageLensConfigurations", "s3express:ListAllMyDirectoryBuckets", "s3express:GetEncryptionConfiguration", "s3express:GetBucketPolicy", "s3-object-lambda:GetObjectAcl", "s3-object-lambda:GetObjectVersionAcl", "s3tables:ListTableBuckets", "s3tables:ListNamespaces", "s3tables:ListTables", "s3tables:GetNamespace", "s3tables:GetTableBucketPolicy", "s3tables:GetTableBucketMaintenanceConfiguration", "s3tables:GetTableMaintenanceConfiguration", "s3tables:GetTablePolicy", "sagemaker:Describe*", "sagemaker:List*", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "sdb:DomainMetadata", "sdb:ListDomains", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetConfigurationPolicyAssociations", "securityhub:BatchGetControlEvaluations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "servicequotas:ListTagsForResource", "ses:Describe*", "ses:GetAccount", "ses:GetAccountSendingEnabled", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "ses:ListConfigurationSets", "ses:ListDedicatedIpPools", "ses:ListIdentities", "ses:ListIdentityPolicies", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListVerifiedEmailAddresses", "shield:Describe*", "shield:GetSubscriptionState", "shield:List*", "snowball:ListClusters", "snowball:ListJobs", "sns:GetPlatformApplicationAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetAutomationExecution", "ssm:GetServiceSetting", "ssm:ListAssociations", "ssm:ListAssociationVersions", "ssm:ListCommands", "ssm:ListComplianceItems", "ssm:ListComplianceSummaries", "ssm:ListDocumentMetadataHistory", "ssm:ListDocuments", "ssm:ListDocumentVersions", "ssm:ListInventoryEntries", "ssm:ListOpsMetadata", "ssm:ListResourceComplianceSummaries", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso:DescribeAccountAssignmentCreationStatus", "sso:DescribePermissionSet", "sso:DescribePermissionsPolicies", "sso:List*", "states:DescribeStateMachine", "states:ListStateMachines", "storagegateway:DescribeBandwidthRateLimit", "storagegateway:DescribeCache", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeGatewayInformation", "storagegateway:DescribeMaintenanceStartTime", "storagegateway:DescribeNFSFileShares", "storagegateway:DescribeSnapshotSchedule", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:DescribeTapeArchives", "storagegateway:DescribeTapeRecoveryPoints", "storagegateway:DescribeTapes", "storagegateway:DescribeUploadBuffer", "storagegateway:DescribeVTLDevices", "storagegateway:DescribeWorkingStorage", "storagegateway:List*", "sts:GetAccessKeyInfo", "support:DescribeTrustedAdvisorCheckRefreshStatuses", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "tag:GetTagKeys", "transcribe:GetCallAnalyticsCategory", "transcribe:GetMedicalVocabulary", "transcribe:GetVocabulary", "transcribe:GetVocabularyFilter", "transcribe:ListCallAnalyticsCategories", "transcribe:ListCallAnalyticsJobs", "transcribe:ListLanguageModels", "transcribe:ListMedicalTranscriptionJobs", "transcribe:ListMedicalVocabularies", "transcribe:ListTagsForResource", "transcribe:ListTranscriptionJobs", "transcribe:ListVocabularies", "transcribe:ListVocabularyFilters", "transfer:Describe*", "transfer:List*", "translate:List*", "trustedadvisor:Describe*", "voiceid:DescribeDomain", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", "waf-regional:ListWebACLs", "waf:GetWebACL", "waf:ListTagsForResource", "waf:ListWebACLs", "wafv2:GetLoggingConfiguration", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListIPSets", "wafv2:ListLoggingConfigurations", "wafv2:ListRegexPatternSets", "wafv2:ListResourcesForWebACL", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "wafv2:ListWebACLs", "wisdom:GetAssistant", "workdocs:DescribeResourcePermissions", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetTraceSummaries", "xray:ListTagsForResource" ], "Resource": "*" }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } } }, "createdDate": "2015-02-06T18:41:01.000Z", "lastUpdatedDate": "2025-03-26T14:07:06.000Z" }, "AmazonSESFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSESFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:02.000Z", "lastUpdatedDate": "2015-02-06T18:41:02.000Z" }, "AmazonSESReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSESReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:Get*", "ses:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-02-06T18:41:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SESReadOnlyAccess", "Effect": "Allow", "Action": [ "ses:Get*", "ses:List*", "ses:BatchGetMetricData" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:03.000Z", "lastUpdatedDate": "2024-05-14T12:03:02.000Z" }, "SimpleWorkflowFullAccess": { "arn": "arn:aws:iam::aws:policy/SimpleWorkflowFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "swf:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:04.000Z", "lastUpdatedDate": "2015-02-06T18:41:04.000Z" }, "AmazonSNSFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sns:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-02-06T18:41:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SNSFullAccess", "Effect": "Allow", "Action": "sns:*", "Resource": "*" }, { "Sid": "SMSAccessViaSNS", "Effect": "Allow", "Action": [ "sms-voice:DescribeVerifiedDestinationNumbers", "sms-voice:CreateVerifiedDestinationNumber", "sms-voice:SendDestinationNumberVerificationCode", "sms-voice:SendTextMessage", "sms-voice:DeleteVerifiedDestinationNumber", "sms-voice:VerifyDestinationNumber", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeSpendLimits", "sms-voice:DescribePhoneNumbers", "sms-voice:SetTextMessageSpendLimitOverride", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DeleteOptedOutNumber" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sns.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:41:05.000Z", "lastUpdatedDate": "2024-09-24T22:32:05.000Z" }, "AmazonSNSReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-02-06T18:41:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SNSReadOnlyAccess", "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:List*", "sns:CheckIfPhoneNumberIsOptedOut", "sns:GetEndpointAttributes", "sns:GetDataProtectionPolicy", "sns:GetPlatformApplicationAttributes", "sns:GetSMSAttributes", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes" ], "Resource": "*" }, { "Sid": "SMSAccessViaSNS", "Effect": "Allow", "Action": [ "sms-voice:DescribeVerifiedDestinationNumbers", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeSpendLimits", "sms-voice:DescribePhoneNumbers", "sms-voice:DescribeOptedOutNumbers" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sns.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:41:06.000Z", "lastUpdatedDate": "2024-09-24T22:13:12.000Z" }, "AmazonSQSFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:07.000Z", "lastUpdatedDate": "2015-02-06T18:41:07.000Z" }, "AmazonSQSReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:41:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-08-20T23:35:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-15T15:37:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListMessageMoveTasks" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-02-06T18:41:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSQSReadOnlyAccess", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:08.000Z", "lastUpdatedDate": "2024-05-24T18:16:44.000Z" }, "AWSStorageGatewayFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSStorageGatewayFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "storagegateway:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DeleteSnapshot" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-09-06T20:26:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "storagegateway:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DeleteSnapshot" ], "Resource": "*" }, { "Sid": "fetchStorageGatewayParams", "Effect": "Allow", "Action": "ssm:GetParameters", "Resource": "arn:aws:ssm:*::parameter/aws/service/storagegateway/*" } ] } } }, "createdDate": "2015-02-06T18:41:09.000Z", "lastUpdatedDate": "2022-09-06T20:26:09.000Z" }, "AWSStorageGatewayReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSStorageGatewayReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "storagegateway:List*", "storagegateway:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-09-06T20:24:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "storagegateway:List*", "storagegateway:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Sid": "fetchStorageGatewayParams", "Effect": "Allow", "Action": "ssm:GetParameters", "Resource": "arn:aws:ssm:*::parameter/aws/service/storagegateway/*" } ] } } }, "createdDate": "2015-02-06T18:41:10.000Z", "lastUpdatedDate": "2022-09-06T20:24:17.000Z" }, "AWSSupportAccess": { "arn": "arn:aws:iam::aws:policy/AWSSupportAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "support:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:11.000Z", "lastUpdatedDate": "2015-02-06T18:41:11.000Z" }, "AWSDirectoryServiceFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectoryServiceFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2015-02-06T18:41:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-02-24T23:10:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "arn:aws:sns:*:*:DirectoryMonitoring*" } ] } }, "v3": { "createdDate": "2018-09-25T21:53:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeSecurityGroups", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "iam:ListRoles", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "arn:aws:sns:*:*:DirectoryMonitoring*" }, { "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": [ "ds.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2019-02-05T20:29:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeSecurityGroups", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "iam:ListRoles", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "arn:aws:sns:*:*:DirectoryMonitoring*" }, { "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": [ "ds.amazonaws.com" ] } } }, { "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Effect": "Allow", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } }, "v5": { "createdDate": "2020-11-24T23:24:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeSecurityGroups", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "iam:ListRoles", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Effect": "Allow", "Resource": "arn:aws:sns:*:*:DirectoryMonitoring*" }, { "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "ds.amazonaws.com" } } }, { "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Effect": "Allow", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } }, "v6": { "createdDate": "2015-02-06T18:41:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DirectoryServiceFullAccess", "Effect": "Allow", "Action": [ "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeSecurityGroups", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "iam:ListRoles", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Sid": "DirectoryServiceEventTopic", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:DirectoryMonitoring*" }, { "Sid": "DirectoryServiceOrganizations", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "ds.amazonaws.com" } } }, { "Sid": "DirectoryServiceTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } } }, "createdDate": "2015-02-06T18:41:11.000Z", "lastUpdatedDate": "2024-04-02T20:38:17.000Z" }, "AWSDirectoryServiceReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectoryServiceReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-06T18:41:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2015-12-04T00:12:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2016-02-24T23:11:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "sns:ListTopics", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-09-25T21:54:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:Check*", "ds:Describe*", "ds:Get*", "ds:List*", "ds:Verify*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "sns:ListTopics", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:12.000Z", "lastUpdatedDate": "2018-09-25T21:54:01.000Z" }, "AmazonZocaloFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonZocaloFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "zocalo:*", "ds:*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:13.000Z", "lastUpdatedDate": "2015-02-06T18:41:13.000Z" }, "AmazonZocaloReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonZocaloReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "zocalo:Describe*", "ds:DescribeDirectories", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:14.000Z", "lastUpdatedDate": "2015-02-06T18:41:14.000Z" }, "AmazonVPCFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2015-02-06T18:41:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateInternetGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachVpnGateway", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:ModifyVpcAttribute", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-03-24T19:54:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateInternetGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachVpnGateway", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2015-05-07T18:04:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateInternetGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachVpnGateway", "ec2:DisableVpcClassicLink", "ec2:DisableVgwRoutePropagation", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVpcClassicLink", "ec2:EnableVgwRoutePropagation", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-12-15T22:01:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:MoveAddressToVpc", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2015-12-17T17:25:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:MoveAddressToVpc", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2017-12-20T16:32:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2018-03-15T18:30:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-06-23T20:58:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-08-02T19:12:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2015-02-06T18:41:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonVPCFullAccess", "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2015-02-06T18:41:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonVPCFullAccess", "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSecurityGroupVpc", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachClassicLinkVpc", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteInternetGateway", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupVpcAssociations", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachClassicLinkVpc", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLink", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSecurityGroupVpc", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLink", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:RejectVpcPeeringConnection", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:16.000Z", "lastUpdatedDate": "2024-12-09T17:21:07.000Z" }, "AmazonVPCReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2015-02-06T18:41:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcPeeringConnection", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-05-07T17:59:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnection", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2015-12-15T22:04:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-12-17T17:25:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-01-02T18:58:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2018-03-07T18:34:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-06-23T17:03:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-08-02T15:47:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2015-02-06T18:41:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonVPCReadOnlyAccess", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2015-02-06T18:41:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonVPCReadOnlyAccess", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupVpcAssociations", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:17.000Z", "lastUpdatedDate": "2024-12-09T15:06:07.000Z" }, "AWSAccountActivityAccess": { "arn": "arn:aws:iam::aws:policy/AWSAccountActivityAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:ViewBilling" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-03-07T17:02:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetRegionOptStatus", "account:ListRegions", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "payments:ListPaymentPreferences" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-portal:ViewBilling" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:18.000Z", "lastUpdatedDate": "2023-03-07T17:02:30.000Z" }, "AWSAccountUsageReportAccess": { "arn": "arn:aws:iam::aws:policy/AWSAccountUsageReportAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:ViewUsage" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:19.000Z", "lastUpdatedDate": "2015-02-06T18:41:19.000Z" }, "AmazonElasticMapReduceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2015-02-06T18:41:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttributes", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select" ] } ] } }, "v2": { "createdDate": "2015-05-13T21:13:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeKeyPairs", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:ReceiveMessage" ] } ] } }, "v3": { "createdDate": "2015-10-28T17:24:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeKeyPairs", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage" ] } ] } }, "v4": { "createdDate": "2015-11-12T19:38:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeKeyPairs", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:AuthorizeSecurityGroupEgress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage" ] } ] } }, "v5": { "createdDate": "2015-12-18T21:47:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage" ] } ] } }, "v6": { "createdDate": "2016-02-10T22:41:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage" ] } ] } }, "v7": { "createdDate": "2016-11-17T23:17:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:Describe*" ] } ] } }, "v8": { "createdDate": "2017-07-17T21:29:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:Describe*" ] } ] } }, "v9": { "createdDate": "2017-12-12T00:47:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:Describe*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spot.amazonaws.com" } } } ] } }, "v10": { "createdDate": "2020-06-24T22:24:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:Describe*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spot.amazonaws.com" } } } ] } } }, "createdDate": "2015-02-06T18:41:20.000Z", "lastUpdatedDate": "2020-06-24T22:24:20.000Z" }, "AmazonElasticMapReduceforEC2Role": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:41:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudwatch:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:Describe*", "rds:Describe*", "s3:*", "sdb:*", "sns:*", "sqs:*" ] } ] } }, "v2": { "createdDate": "2015-05-13T21:23:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudwatch:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSteps", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:MergeShards", "kinesis:PutRecord", "kinesis:SplitShard", "rds:Describe*", "s3:*", "sdb:*", "sns:*", "sqs:*" ] } ] } }, "v3": { "createdDate": "2017-08-11T23:57:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudwatch:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSteps", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:MergeShards", "kinesis:PutRecord", "kinesis:SplitShard", "rds:Describe*", "s3:*", "sdb:*", "sns:*", "sqs:*", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:CreatePartition", "glue:BatchCreatePartition", "glue:UpdatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:CreateUserDefinedFunction", "glue:UpdateUserDefinedFunction", "glue:DeleteUserDefinedFunction", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ] } ] } } }, "createdDate": "2015-02-06T18:41:21.000Z", "lastUpdatedDate": "2017-08-11T23:57:30.000Z" }, "AutoScalingNotificationAccessRole": { "arn": "arn:aws:iam::aws:policy/service-role/AutoScalingNotificationAccessRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "sqs:SendMessage", "sqs:GetQueueUrl", "sns:Publish" ] } ] } } }, "createdDate": "2015-02-06T18:41:22.000Z", "lastUpdatedDate": "2015-02-06T18:41:22.000Z" }, "AWSCloudHSMRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCloudHSMRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:41:23.000Z", "lastUpdatedDate": "2015-02-06T18:41:23.000Z" }, "AmazonEC2RoleforDataPipelineRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-06T18:41:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:List*", "s3:Put*", "s3:Get*", "s3:DeleteObject", "dynamodb:DescribeTable", "dynamodb:Scan", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:UpdateTable", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "cloudwatch:PutMetricData", "datapipeline:PollForTask", "datapipeline:ReportTaskProgress", "datapipeline:SetTaskStatus", "datapipeline:PollForTask", "datapipeline:ReportTaskRunnerHeartbeat" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2015-03-19T19:18:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:*", "datapipeline:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:Describe*", "elasticmapreduce:ListInstance*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "s3:*", "sdb:*", "sns:*", "sqs:*" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2016-02-22T17:24:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:*", "datapipeline:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:Describe*", "elasticmapreduce:ListInstance*", "elasticmapreduce:ModifyInstanceGroups", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "s3:*", "sdb:*", "sns:*", "sqs:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:41:25.000Z", "lastUpdatedDate": "2016-02-22T17:24:05.000Z" }, "AmazonElasticTranscoderRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonElasticTranscoderRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "1", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:Put*", "s3:Get*", "s3:*MultipartUpload*" ], "Resource": [ "*" ] }, { "Sid": "2", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "*" ] }, { "Sid": "3", "Effect": "Deny", "Action": [ "s3:*Policy*", "sns:*Permission*", "sns:*Delete*", "s3:*Delete*", "sns:*Remove*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-06-13T22:48:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:Get*", "s3:PutObject", "s3:PutObjectAcl", "s3:*MultipartUpload*" ], "Sid": "1", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Sid": "2", "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:41:26.000Z", "lastUpdatedDate": "2019-06-13T22:48:22.000Z" }, "AWSLambdaRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:41:28.000Z", "lastUpdatedDate": "2015-02-06T18:41:28.000Z" }, "RDSCloudHsmAuthorizationRole": { "arn": "arn:aws:iam::aws:policy/service-role/RDSCloudHsmAuthorizationRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-02-06T18:41:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudhsm:CreateLunaClient", "cloudhsm:GetClientConfiguration", "cloudhsm:DeleteLunaClient", "cloudhsm:DescribeLunaClient", "cloudhsm:ModifyLunaClient", "cloudhsm:DescribeHapg", "cloudhsm:ModifyHapg", "cloudhsm:GetConfig" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-26T22:14:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudhsm:CreateLunaClient", "cloudhsm:DeleteLunaClient", "cloudhsm:DescribeHapg", "cloudhsm:DescribeLunaClient", "cloudhsm:GetConfig", "cloudhsm:ModifyHapg", "cloudhsm:ModifyLunaClient" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-06T18:41:29.000Z", "lastUpdatedDate": "2019-09-26T22:14:29.000Z" }, "AmazonSNSRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSNSRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-02-06T18:41:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutMetricFilter", "logs:PutRetentionPolicy" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-02-06T18:41:30.000Z", "lastUpdatedDate": "2015-02-06T18:41:30.000Z" }, "AWSConnector": { "arn": "arn:aws:iam::aws:policy/AWSConnector", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-02-11T17:14:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::import-to-ec2-*" }, { "Effect": "Allow", "Action": [ "ec2:CancelConversionTask", "ec2:CancelExportTask", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DescribeConversionTasks", "ec2:DescribeExportTasks", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeTags", "ec2:DetachVolume", "ec2:ImportInstance", "ec2:ImportVolume", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" } ] } }, "v2": { "createdDate": "2015-02-19T22:38:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::import-to-ec2-*" }, { "Effect": "Allow", "Action": [ "ec2:CancelConversionTask", "ec2:CancelExportTask", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DescribeConversionTasks", "ec2:DescribeExportTasks", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeTags", "ec2:DetachVolume", "ec2:ImportInstance", "ec2:ImportVolume", "ec2:ModifyInstanceAttribute", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" } ] } }, "v3": { "createdDate": "2015-09-28T19:50:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": "arn:aws:s3:::import-to-ec2-*" }, { "Effect": "Allow", "Action": [ "ec2:CancelConversionTask", "ec2:CancelExportTask", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DescribeConversionTasks", "ec2:DescribeExportTasks", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeTags", "ec2:DetachVolume", "ec2:ImportInstance", "ec2:ImportVolume", "ec2:ModifyInstanceAttribute", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DeleteSnapshot", "ec2:CancelImportTask", "ec2:ImportSnapshot", "ec2:DescribeImportSnapshotTasks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" } ] } } }, "createdDate": "2015-02-11T17:14:31.000Z", "lastUpdatedDate": "2015-09-28T19:50:38.000Z" }, "AWSMarketplaceFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-11T17:21:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:*", "cloudformation:CreateStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:List*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-07-31T23:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:*", "cloudformation:CreateStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:List*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DeleteSnapshot", "ssm:GetAutomationExecution", "ssm:UpdateDocumentDefaultVersion", "ssm:CreateDocument", "ssm:StartAutomationExecution", "ssm:ListDocuments", "ssm:UpdateDocument", "ssm:DescribeDocument", "sns:ListTopics", "sns:GetTopicAttributes", "sns:CreateTopic", "iam:GetRole", "iam:GetInstanceProfile", "iam:ListRoles", "iam:ListInstanceProfiles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish", "sns:setTopicAttributes" ], "Resource": "arn:aws:sns:*:*:*image-build*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2018-08-08T21:13:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:*", "cloudformation:CreateStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:List*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DeleteSnapshot", "ec2:CreateImage", "ec2:DescribeInstanceStatus", "ssm:GetAutomationExecution", "ssm:UpdateDocumentDefaultVersion", "ssm:CreateDocument", "ssm:StartAutomationExecution", "ssm:ListDocuments", "ssm:UpdateDocument", "ssm:DescribeDocument", "sns:ListTopics", "sns:GetTopicAttributes", "sns:CreateTopic", "iam:GetRole", "iam:GetInstanceProfile", "iam:ListRoles", "iam:ListInstanceProfiles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish", "sns:setTopicAttributes" ], "Resource": "arn:aws:sns:*:*:*image-build*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2022-03-04T17:04:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:*", "cloudformation:CreateStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:List*", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DeleteSnapshot", "ec2:CreateImage", "ec2:DescribeInstanceStatus", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:DescribeDocument", "sns:ListTopics", "sns:GetTopicAttributes", "sns:CreateTopic", "iam:GetRole", "iam:GetInstanceProfile", "iam:ListRoles", "iam:ListInstanceProfiles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish", "sns:setTopicAttributes" ], "Resource": "arn:aws:sns:*:*:*image-build*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*", "arn:aws:ssm:us-east-1:058657716661:automation-definition/*", "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*", "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*", "arn:aws:ssm:us-west-2:243045473901:automation-definition/*", "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*", "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*", "arn:aws:ssm:us-east-2:134937423163:automation-definition/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ssm.amazonaws.com" ], "iam:AssociatedResourceARN": [ "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*", "arn:aws:ssm:us-east-1:058657716661:automation-definition/*", "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*", "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*", "arn:aws:ssm:us-west-2:243045473901:automation-definition/*", "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*", "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*", "arn:aws:ssm:us-east-2:134937423163:automation-definition/*" ] } } } ] } } }, "createdDate": "2015-02-11T17:21:45.000Z", "lastUpdatedDate": "2022-03-04T17:04:00.000Z" }, "AWSConfigUserAccess": { "arn": "arn:aws:iam::aws:policy/AWSConfigUserAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-02-18T19:38:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:Get*", "config:Describe*", "config:Deliver*", "tag:GetResources", "tag:GetTagKeys" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-09-02T17:44:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:Get*", "config:Describe*", "config:Deliver*", "config:List*", "tag:GetResources", "tag:GetTagKeys" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-03-18T20:27:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:Get*", "config:Describe*", "config:Deliver*", "config:List*", "config:Select*", "tag:GetResources", "tag:GetTagKeys", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-08-30T19:15:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:Get*", "config:Describe*", "config:Deliver*", "config:List*", "tag:GetResources", "tag:GetTagKeys", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents" ], "Resource": "*" } ] } } }, "createdDate": "2015-02-18T19:38:41.000Z", "lastUpdatedDate": "2019-03-18T20:27:47.000Z" }, "AmazonEC2ContainerServiceforEC2Role": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2015-03-19T18:45:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:Submit*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-08-17T23:33:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:Submit*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2015-12-19T00:12:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2016-05-04T18:56:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-05-17T23:09:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:UpdateContainerInstancesState", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-06-13T19:11:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:UpdateContainerInstancesState", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2023-03-06T22:19:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:UpdateContainerInstancesState", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ecs:TagResource", "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterContainerInstance" ] } } } ] } } }, "createdDate": "2015-03-19T18:45:18.000Z", "lastUpdatedDate": "2023-03-06T22:19:04.000Z" }, "AmazonCognitoReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonCognitoReadOnly", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-03-24T17:06:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "iam:ListOpenIdConnectProviders", "iam:ListRoles", "sns:ListPlatformApplications" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-06-02T17:30:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-idp:Describe*", "cognito-idp:AdminGetUser", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "iam:ListOpenIdConnectProviders", "iam:ListRoles", "sns:ListPlatformApplications" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-08-01T19:21:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-idp:Describe*", "cognito-idp:AdminGet*", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-idp:Get*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "iam:ListOpenIdConnectProviders", "iam:ListRoles", "sns:ListPlatformApplications" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-02-16T00:18:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:Describe*", "cognito-identity:Get*", "cognito-identity:List*", "cognito-idp:Describe*", "cognito-idp:AdminGetUser", "cognito-idp:AdminList*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:Get*", "cognito-sync:List*", "iam:ListOpenIdConnectProviders", "iam:ListRoles", "sns:ListPlatformApplications" ], "Resource": "*" } ] } } }, "createdDate": "2015-03-24T17:06:46.000Z", "lastUpdatedDate": "2019-08-01T19:21:04.000Z" }, "AmazonCognitoPowerUser": { "arn": "arn:aws:iam::aws:policy/AmazonCognitoPowerUser", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2015-03-24T17:14:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "sns:ListPlatformApplications" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-06-02T16:57:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "sns:ListPlatformApplications" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-07-16T17:25:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "sns:ListPlatformApplications", "iam:GetRole", "iam:ListOpenIDConnectProviders", "iam:ListRoles", "iam:ListSAMLProviders", "iam:GetSAMLProvider", "kinesis:ListStreams", "lambda:GetPolicy", "lambda:GetPolicy2*", "lambda:ListFunctions", "lambda:ListFunctions2*", "sns:ListPlatformApplications", "ses:ListIdentities", "ses:GetIdentityVerificationAttributes", "mobiletargeting:GetApps", "acm:ListCertificates" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "cognito-idp.amazonaws.com", "email.cognito-idp.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdp*", "arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*" ] } ] } }, "v3": { "createdDate": "2019-03-29T22:06:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "sns:ListPlatformApplications" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "email.cognito-idp.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*" } ] } }, "v5": { "createdDate": "2021-01-12T16:56:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "sns:ListPlatformApplications", "iam:GetRole", "iam:ListOpenIDConnectProviders", "iam:ListRoles", "iam:ListSAMLProviders", "iam:GetSAMLProvider", "kinesis:ListStreams", "lambda:GetPolicy", "lambda:ListFunctions", "sns:ListPlatformApplications", "ses:ListIdentities", "ses:GetIdentityVerificationAttributes", "mobiletargeting:GetApps", "acm:ListCertificates" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "cognito-idp.amazonaws.com", "email.cognito-idp.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdp*", "arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*" ] } ] } }, "v6": { "createdDate": "2021-05-27T22:48:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "iam:GetRole", "iam:ListSAMLProviders", "iam:GetSAMLProvider", "kinesis:ListStreams", "lambda:GetPolicy", "lambda:ListFunctions", "sns:GetSMSSandboxAccountStatus", "sns:ListPlatformApplications", "ses:ListIdentities", "ses:GetIdentityVerificationAttributes", "mobiletargeting:GetApps", "acm:ListCertificates" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "cognito-idp.amazonaws.com", "email.cognito-idp.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdp*", "arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*" ] } ] } }, "v7": { "createdDate": "2015-03-24T17:14:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "iam:ListRoles", "iam:ListOpenIdConnectProviders", "iam:GetRole", "iam:ListSAMLProviders", "iam:GetSAMLProvider", "kinesis:ListStreams", "lambda:GetPolicy", "lambda:ListFunctions", "sns:GetSMSSandboxAccountStatus", "sns:ListPlatformApplications", "ses:ListIdentities", "ses:GetIdentityVerificationAttributes", "mobiletargeting:GetApps", "acm:ListCertificates", "sms-voice:DescribeAccountAttributes" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "cognito-idp.amazonaws.com", "email.cognito-idp.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdp*", "arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*" ] } ] } } }, "createdDate": "2015-03-24T17:14:56.000Z", "lastUpdatedDate": "2025-02-27T18:37:05.000Z" }, "AmazonCognitoDeveloperAuthenticatedIdentities": { "arn": "arn:aws:iam::aws:policy/AmazonCognitoDeveloperAuthenticatedIdentities", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-03-24T17:22:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-identity:GetOpenIdTokenForDeveloperIdentity", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:MergeDeveloperIdentities", "cognito-identity:UnlinkDeveloperIdentity" ], "Resource": "*" } ] } } }, "createdDate": "2015-03-24T17:22:23.000Z", "lastUpdatedDate": "2015-03-24T17:22:23.000Z" }, "AmazonWorkSpacesApplicationManagerAdminAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesApplicationManagerAdminAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T14:03:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "wam:AuthenticatePackager", "Resource": "*" } ] } } }, "createdDate": "2015-04-09T14:03:18.000Z", "lastUpdatedDate": "2015-04-09T14:03:18.000Z" }, "AWSLambdaBasicExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T15:03:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T15:03:43.000Z", "lastUpdatedDate": "2015-04-09T15:03:43.000Z" }, "AWSLambdaDynamoDBExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T15:09:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListStreams", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T15:09:29.000Z", "lastUpdatedDate": "2015-04-09T15:09:29.000Z" }, "AWSLambdaKinesisExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-04-09T15:14:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListStreams", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-11-19T20:09:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards", "kinesis:ListStreams", "kinesis:SubscribeToShard", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T15:14:16.000Z", "lastUpdatedDate": "2018-11-19T20:09:24.000Z" }, "AmazonEC2ContainerServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2016-08-11T13:08:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-04-09T16:14:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T16:14:19.000Z", "lastUpdatedDate": "2016-08-11T13:08:01.000Z" }, "AmazonMachineLearningBatchPredictionsAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningBatchPredictionsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T17:12:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:CreateBatchPrediction", "machinelearning:DeleteBatchPrediction", "machinelearning:DescribeBatchPredictions", "machinelearning:GetBatchPrediction", "machinelearning:UpdateBatchPrediction" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:12:19.000Z", "lastUpdatedDate": "2015-04-09T17:12:19.000Z" }, "AmazonMachineLearningCreateOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningCreateOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-04-09T17:18:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:Create*", "machinelearning:Delete*", "machinelearning:Describe*", "machinelearning:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-06-29T20:55:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:Add*", "machinelearning:Create*", "machinelearning:Delete*", "machinelearning:Describe*", "machinelearning:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:18:09.000Z", "lastUpdatedDate": "2016-06-29T20:55:03.000Z" }, "AmazonMachineLearningFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T17:25:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:25:41.000Z", "lastUpdatedDate": "2015-04-09T17:25:41.000Z" }, "AmazonMachineLearningManageRealTimeEndpointOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningManageRealTimeEndpointOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T17:32:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:CreateRealtimeEndpoint", "machinelearning:DeleteRealtimeEndpoint" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:32:41.000Z", "lastUpdatedDate": "2015-04-09T17:32:41.000Z" }, "AmazonMachineLearningReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T17:40:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:Describe*", "machinelearning:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:40:02.000Z", "lastUpdatedDate": "2015-04-09T17:40:02.000Z" }, "AmazonMachineLearningRealTimePredictionOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMachineLearningRealTimePredictionOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-04-09T17:44:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "machinelearning:Predict" ], "Resource": "*" } ] } } }, "createdDate": "2015-04-09T17:44:06.000Z", "lastUpdatedDate": "2015-04-09T17:44:06.000Z" }, "AWSCodeDeployRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2015-05-04T18:05:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "tag:GetTags", "tag:GetResources" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-02-17T16:35:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "tag:GetTags", "tag:GetResources", "sns:Publish" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-09-14T22:11:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "tag:GetTags", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-01-24T23:42:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutLifecycleHook", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetTags", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-08-08T20:43:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutLifecycleHook", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetTags", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2017-09-11T19:09:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutLifecycleHook", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetTags", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-09-23T21:47:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutLifecycleHook", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-05-19T00:42:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:AttachLoadBalancerTargetGroups", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutWarmPool", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-05-19T17:11:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:AttachLoadBalancerTargetGroups", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutLifecycleHook", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2023-02-03T18:04:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:AttachLoadBalancerTargetGroups", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutWarmPool", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2015-05-04T18:05:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:DeleteLifecycleHook", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLifecycleHooks", "autoscaling:PutLifecycleHook", "autoscaling:RecordLifecycleActionHeartbeat", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:UpdateAutoScalingGroup", "autoscaling:EnableMetricsCollection", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeNotificationConfigurations", "autoscaling:SuspendProcesses", "autoscaling:ResumeProcesses", "autoscaling:AttachLoadBalancers", "autoscaling:AttachLoadBalancerTargetGroups", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:PutWarmPool", "autoscaling:DescribeScalingActivities", "autoscaling:DeleteAutoScalingGroup", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:TerminateInstances", "tag:GetResources", "sns:Publish", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-04T18:05:37.000Z", "lastUpdatedDate": "2023-08-16T20:38:58.000Z" }, "AmazonEC2RoleforAWSCodeDeploy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeploy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-05-19T18:10:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListObjects" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-03-20T17:14:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-05-19T18:10:14.000Z", "lastUpdatedDate": "2017-03-20T17:14:10.000Z" }, "AWSCodeDeployFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-05-19T18:13:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "codedeploy:*", "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-05T22:57:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "codedeploy:*", "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-02T16:14:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "codedeploy:*", "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-05-19T18:13:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "codedeploy:*", "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*:*:application:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-19T18:13:23.000Z", "lastUpdatedDate": "2024-12-16T20:22:06.000Z" }, "AWSCodeDeployDeployerAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeDeployDeployerAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-05-19T18:18:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:CreateDeployment", "codedeploy:Get*", "codedeploy:List*", "codedeploy:RegisterApplicationRevision" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-05T22:59:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:CreateDeployment", "codedeploy:Get*", "codedeploy:List*", "codedeploy:RegisterApplicationRevision" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-02T16:16:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:CreateDeployment", "codedeploy:Get*", "codedeploy:List*", "codedeploy:RegisterApplicationRevision" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-05-19T18:18:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:CreateDeployment", "codedeploy:Get*", "codedeploy:List*", "codedeploy:RegisterApplicationRevision" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*:*:application:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-19T18:18:43.000Z", "lastUpdatedDate": "2024-12-16T20:22:07.000Z" }, "AWSCodeDeployReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeDeployReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2019-11-05T23:01:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-05-19T18:21:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-02T16:20:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-05-19T18:21:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codedeploy:*:*:application:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-19T18:21:32.000Z", "lastUpdatedDate": "2024-12-16T20:07:07.000Z" }, "AmazonElasticFileSystemFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2015-05-27T16:22:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-07-26T15:48:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2019-11-05T17:10:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:*", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2017-08-14T10:18:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:*", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-01-13T16:15:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2020-07-16T16:46:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutBackupPolicy", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2021-05-10T14:25:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutAccountPreferences", "elasticfilesystem:PutBackupPolicy", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2022-01-10T19:03:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:CreateReplicationConfiguration", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DeleteReplicationConfiguration", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutAccountPreferences", "elasticfilesystem:PutBackupPolicy", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2015-05-27T16:22:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:CreateReplicationConfiguration", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DeleteReplicationConfiguration", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutAccountPreferences", "elasticfilesystem:PutBackupPolicy", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:UpdateFileSystemProtection", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "kms:DescribeKey", "kms:ListAliases" ], "Sid": "ElasticFileSystemFullAccess", "Effect": "Allow", "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Sid": "CreateServiceLinkedRoleForEFS", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2015-05-27T16:22:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticFileSystemFullAccess", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateTags", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:CreateReplicationConfiguration", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:DeleteTags", "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DeleteFileSystemPolicy", "elasticfilesystem:DeleteReplicationConfiguration", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ModifyMountTargetSecurityGroups", "elasticfilesystem:PutAccountPreferences", "elasticfilesystem:PutBackupPolicy", "elasticfilesystem:PutLifecycleConfiguration", "elasticfilesystem:PutFileSystemPolicy", "elasticfilesystem:UpdateFileSystem", "elasticfilesystem:UpdateFileSystemProtection", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:Backup", "elasticfilesystem:Restore", "elasticfilesystem:ReplicationRead", "elasticfilesystem:ReplicationWrite", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "CreateServiceLinkedRoleForEFS", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticfilesystem.amazonaws.com" ] } } }, { "Sid": "IAMPassRoleAccessForEFS", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "elasticfilesystem.amazonaws.com" } } } ] } } }, "createdDate": "2015-05-27T16:22:28.000Z", "lastUpdatedDate": "2024-11-07T19:34:20.000Z" }, "AmazonElasticFileSystemReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemReadOnlyAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2015-05-27T16:25:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticfilesystem:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-07-26T16:17:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-08-14T10:09:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:Describe*", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-01-13T16:16:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ListTagsForResource", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2021-05-10T14:20:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ListTagsForResource", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-07-16T16:46:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:ListTagsForResource", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2022-01-10T18:53:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ListTagsForResource", "kms:ListAliases" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2015-05-27T16:25:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticFileSystemReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ListTagsForResource", "kms:ListAliases" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2015-05-27T16:25:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticFileSystemReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticfilesystem:DescribeAccountPreferences", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:ListTagsForResource", "elasticfilesystem:ReplicationRead", "kms:ListAliases" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-27T16:25:25.000Z", "lastUpdatedDate": "2024-11-07T19:39:56.000Z" }, "AmazonSSMFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSSMFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-05-29T17:39:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeInstanceStatus", "logs:*", "ssm:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-03-07T21:09:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeInstanceStatus", "logs:*", "ssm:*", "ec2messages:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-07-23T22:53:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeInstanceStatus", "logs:*", "ssm:*", "ec2messages:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*", "Condition": { "StringLike": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*" } ] } }, "v4": { "createdDate": "2019-11-20T20:08:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeInstanceStatus", "logs:*", "ssm:*", "ec2messages:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*", "Condition": { "StringLike": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-29T17:39:47.000Z", "lastUpdatedDate": "2019-11-20T20:08:56.000Z" }, "AmazonSSMReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-05-29T17:44:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:Describe*", "ssm:Get*", "ssm:List*" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-29T17:44:19.000Z", "lastUpdatedDate": "2015-05-29T17:44:19.000Z" }, "AmazonEC2RoleforSSM": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v2": { "createdDate": "2015-10-23T22:12:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDocument", "ssm:ListAssociations", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2015-05-29T17:48:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:CreateComputer", "ds:DescribeDirectories", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "ssm:DescribeAssociation", "ssm:GetDocument", "ssm:ListAssociations", "ssm:UpdateAssociationStatus" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-12-01T07:07:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-ssm-packages-*" } ] } }, "v4": { "createdDate": "2017-08-10T20:49:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-ssm-packages-*" } ] } }, "v5": { "createdDate": "2017-09-22T21:04:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2018-08-15T14:24:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-01-24T19:20:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2018-10-24T19:37:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" } ] } } }, "createdDate": "2015-05-29T17:48:35.000Z", "lastUpdatedDate": "2019-01-24T19:20:51.000Z" }, "CloudWatchActionsEC2Access": { "arn": "arn:aws:iam::aws:policy/CloudWatchActionsEC2Access", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-07-07T00:00:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:Describe*", "ec2:Describe*", "ec2:RebootInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" } ] } } }, "createdDate": "2015-07-07T00:00:33.000Z", "lastUpdatedDate": "2015-07-07T00:00:33.000Z" }, "AWSCodePipelineCustomActionAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodePipelineCustomActionAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-07-09T17:02:54.000Z", "document": { "Statement": [ { "Action": [ "codepipeline:AcknowledgeJob", "codepipeline:GetJobDetails", "codepipeline:PollForJobs", "codepipeline:PutJobFailureResult", "codepipeline:PutJobSuccessResult" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" } } }, "createdDate": "2015-07-09T17:02:54.000Z", "lastUpdatedDate": "2015-07-09T17:02:54.000Z" }, "AWSCodeCommitFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2015-07-09T17:02:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-20T20:04:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v4": { "createdDate": "2019-11-05T21:02:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" } ] } }, "v5": { "createdDate": "2019-11-05T23:00:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" } ] } }, "v3": { "createdDate": "2019-06-12T21:27:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v6": { "createdDate": "2019-12-03T07:56:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2020-07-30T23:17:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } }, "v8": { "createdDate": "2020-06-24T17:08:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2020-03-26T16:23:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2023-07-17T21:50:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } }, "v11": { "createdDate": "2015-07-09T17:02:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:*" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*:*:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } } }, "createdDate": "2015-07-09T17:02:19.000Z", "lastUpdatedDate": "2025-01-10T20:07:06.000Z" }, "AWSCodeCommitReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSCodeCommitReadOnly", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2015-07-09T17:05:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:GitPull", "codecommit:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-20T20:01:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:Get*", "codecommit:Describe*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v3": { "createdDate": "2019-05-15T17:26:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:Describe*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v4": { "createdDate": "2019-11-05T20:46:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:Describe*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2019-11-05T22:56:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:Describe*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-11-20T17:12:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-12-03T08:08:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-03-26T16:09:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-06-24T16:06:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2020-07-30T23:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2021-08-18T18:18:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2015-07-09T17:05:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Describe*", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*:*:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" } ] } } }, "createdDate": "2015-07-09T17:05:06.000Z", "lastUpdatedDate": "2025-01-10T20:07:07.000Z" }, "AWSCodeCommitPowerUser": { "arn": "arn:aws:iam::aws:policy/AWSCodeCommitPowerUser", "latestVersionId": "v16", "versionsCount": 16, "versions": { "v1": { "createdDate": "2015-07-09T17:06:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Update*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-10-22T17:21:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-05-22T21:12:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:DeleteBranch", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-11-20T20:02:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:Test*", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v5": { "createdDate": "2019-05-15T23:18:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:Batch*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:Test*", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v6": { "createdDate": "2019-05-30T19:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials", "iam:ListAccessKeys", "iam:GetSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v7": { "createdDate": "2019-06-12T22:47:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } }, "v8": { "createdDate": "2019-11-05T20:55:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2019-11-05T22:52:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Get*", "codecommit:List*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:Put*", "codecommit:Post*", "codecommit:Merge*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2019-11-20T17:12:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2019-12-03T08:15:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v12": { "createdDate": "2020-03-26T16:17:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2020-06-24T16:16:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2020-07-30T23:12:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } }, "v15": { "createdDate": "2023-07-17T21:49:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } }, "v16": { "createdDate": "2015-07-09T17:06:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:AssociateApprovalRuleTemplateWithRepository", "codecommit:BatchAssociateApprovalRuleTemplateWithRepositories", "codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories", "codecommit:BatchGet*", "codecommit:BatchDescribe*", "codecommit:Create*", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:Describe*", "codecommit:DisassociateApprovalRuleTemplateFromRepository", "codecommit:EvaluatePullRequestApprovalRules", "codecommit:Get*", "codecommit:List*", "codecommit:Merge*", "codecommit:OverridePullRequestApprovalRules", "codecommit:Put*", "codecommit:Post*", "codecommit:TagResource", "codecommit:Test*", "codecommit:UntagResource", "codecommit:Update*", "codecommit:GitPull", "codecommit:GitPush" ], "Resource": "*" }, { "Sid": "CloudWatchEventsCodeCommitRulesAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/codecommit*" }, { "Sid": "SNSTopicAndSubscriptionAccess", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:codecommit*" }, { "Sid": "SNSTopicAndSubscriptionReadAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "LambdaReadOnlyListAccess", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Sid": "IAMReadOnlyListAccess", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "*" }, { "Sid": "IAMReadOnlyConsoleAccess", "Effect": "Allow", "Action": [ "iam:ListAccessKeys", "iam:ListSSHPublicKeys", "iam:ListServiceSpecificCredentials" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMUserSSHKeys", "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "IAMSelfManageServiceSpecificCredentials", "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*:*:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:AssociateRepository", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codeguru-reviewer:DisassociateRepository", "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } } }, "createdDate": "2015-07-09T17:06:49.000Z", "lastUpdatedDate": "2025-01-10T20:07:07.000Z" }, "IAMUserSSHKeys": { "arn": "arn:aws:iam::aws:policy/IAMUserSSHKeys", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-07-09T17:08:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:DeleteSSHPublicKey", "iam:GetSSHPublicKey", "iam:ListSSHPublicKeys", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } } }, "createdDate": "2015-07-09T17:08:54.000Z", "lastUpdatedDate": "2015-07-09T17:08:54.000Z" }, "AmazonAPIGatewayAdministrator": { "arn": "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-07-09T17:34:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:*" ], "Resource": "arn:aws:apigateway:*::/*" } ] } } }, "createdDate": "2015-07-09T17:34:45.000Z", "lastUpdatedDate": "2015-07-09T17:34:45.000Z" }, "AmazonAPIGatewayInvokeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-07-09T17:36:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "execute-api:Invoke" ], "Resource": "arn:aws:execute-api:*:*:*" } ] } }, "v2": { "createdDate": "2018-12-18T18:25:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": "arn:aws:execute-api:*:*:*" } ] } } }, "createdDate": "2015-07-09T17:36:12.000Z", "lastUpdatedDate": "2018-12-18T18:25:10.000Z" }, "AWSDeviceFarmFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDeviceFarmFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-07-13T16:37:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "devicefarm:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-07-13T16:37:38.000Z", "lastUpdatedDate": "2015-07-13T16:37:38.000Z" }, "AmazonDRSVPCManagement": { "arn": "arn:aws:iam::aws:policy/AmazonDRSVPCManagement", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-09-02T00:09:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } } }, "createdDate": "2015-09-02T00:09:20.000Z", "lastUpdatedDate": "2015-09-02T00:09:20.000Z" }, "VMImportExportRoleForAWSConnector": { "arn": "arn:aws:iam::aws:policy/service-role/VMImportExportRoleForAWSConnector", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-09-03T20:48:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::import-to-ec2-*" ] }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2015-09-03T20:48:59.000Z", "lastUpdatedDate": "2015-09-03T20:48:59.000Z" }, "AmazonWorkSpacesAdmin": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesAdmin", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v2": { "createdDate": "2016-08-18T23:08:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "workspaces:CreateWorkspaces", "workspaces:DescribeWorkspaces", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:TerminateWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:ModifyWorkspaceProperties", "workspaces:StopWorkspaces", "workspaces:StartWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:CreateTags", "workspaces:DeleteTags", "workspaces:DescribeTags", "kms:ListKeys", "kms:ListAliases", "kms:DescribeKey" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2015-09-22T22:21:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "workspaces:CreateWorkspaces", "workspaces:DescribeWorkspaces", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:TerminateWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2022-12-15T19:43:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaceImage", "workspaces:CreateWorkspaces", "workspaces:CreateStandbyWorkspaces", "workspaces:DeleteTags", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyCertificateBasedAuthProperties", "workspaces:ModifySamlProperties", "workspaces:ModifyWorkspaceProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:StartWorkspaces", "workspaces:StopWorkspaces", "workspaces:TerminateWorkspaces" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-08-31T18:28:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaces", "workspaces:CreateWorkspaceImage", "workspaces:DeleteTags", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyWorkspaceProperties", "workspaces:ModifySamlProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:StartWorkspaces", "workspaces:StopWorkspaces", "workspaces:TerminateWorkspaces" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-08-03T23:57:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaceImage", "workspaces:CreateWorkspaces", "workspaces:CreateStandbyWorkspaces", "workspaces:DeleteTags", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyCertificateBasedAuthProperties", "workspaces:ModifySamlProperties", "workspaces:ModifyWorkspaceProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:RestoreWorkspace", "workspaces:StartWorkspaces", "workspaces:StopWorkspaces", "workspaces:TerminateWorkspaces" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2015-09-22T22:21:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonWorkSpacesAdmin", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "workspaces:CreateTags", "workspaces:CreateWorkspaceImage", "workspaces:CreateWorkspaces", "workspaces:CreateWorkspacesPool", "workspaces:CreateStandbyWorkspaces", "workspaces:DeleteTags", "workspaces:DeregisterWorkspaceDirectory", "workspaces:DescribeTags", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspacesPools", "workspaces:DescribeWorkspacesPoolSessions", "workspaces:DescribeWorkspacesConnectionStatus", "workspaces:ModifyCertificateBasedAuthProperties", "workspaces:ModifySamlProperties", "workspaces:ModifyStreamingProperties", "workspaces:ModifyWorkspaceCreationProperties", "workspaces:ModifyWorkspaceProperties", "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:RegisterWorkspaceDirectory", "workspaces:RestoreWorkspace", "workspaces:StartWorkspaces", "workspaces:StartWorkspacesPool", "workspaces:StopWorkspaces", "workspaces:StopWorkspacesPool", "workspaces:TerminateWorkspaces", "workspaces:TerminateWorkspacesPool", "workspaces:TerminateWorkspacesPoolSession", "workspaces:UpdateWorkspacesPool" ], "Resource": "*" } ] } } }, "createdDate": "2015-09-22T22:21:15.000Z", "lastUpdatedDate": "2024-06-27T17:16:27.000Z" }, "AmazonESFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonESFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-10-01T19:14:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "es:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-10-01T19:14:00.000Z", "lastUpdatedDate": "2015-10-01T19:14:00.000Z" }, "AmazonESReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonESReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-10-01T19:18:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "es:Describe*", "es:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-10-03T03:32:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "es:Describe*", "es:List*", "es:Get*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-10-01T19:18:24.000Z", "lastUpdatedDate": "2018-10-03T03:32:56.000Z" }, "AWSWAFReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2015-10-06T20:43:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-12-07T21:30:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-06-22T22:38:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*", "wafv2:CheckCapacity" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-01-07T19:27:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2023-03-30T20:53:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*", "wafv2:CheckCapacity", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2022-08-25T20:12:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*", "wafv2:CheckCapacity", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2023-05-31T19:12:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*", "wafv2:CheckCapacity", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2023-06-05T20:55:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "wafv2:Get*", "wafv2:List*", "wafv2:Describe*", "wafv2:CheckCapacity", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "apprunner:ListAssociatedServicesForWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-10-06T20:43:45.000Z", "lastUpdatedDate": "2023-06-05T20:55:48.000Z" }, "AWSWAFFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSWAFFullAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2015-10-06T20:44:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-12-07T21:33:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:*", "waf-regional:*", "elasticloadbalancing:SetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-01-07T20:50:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-04-08T00:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-10-01T20:13:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2021-11-15T19:33:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*", "arn:aws:logs:*:*:aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:aws-waf-logs-*" ] } ] } }, "v7": { "createdDate": "2022-01-11T19:33:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2023-03-30T20:24:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2022-08-25T20:11:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2023-05-31T19:08:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "ec2:AssociateVerifiedAccessInstanceWebAcl", "ec2:DisassociateVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2023-06-05T20:55:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "appsync:SetWebACL", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "apprunner:ListAssociatedServicesForWebAcl", "ec2:AssociateVerifiedAccessInstanceWebAcl", "ec2:DisassociateVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } } }, "createdDate": "2015-10-06T20:44:00.000Z", "lastUpdatedDate": "2023-06-05T20:55:25.000Z" }, "AmazonInspectorReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonInspectorReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-10-07T17:08:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:Preview*", "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-03-09T04:06:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:Preview*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-09-12T16:53:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:LocalizeText", "inspector:Preview*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics", "events:DescribeRule", "events:ListRuleNamesByTarget" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-10-01T15:17:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:Describe*", "inspector:Get*", "inspector:List*", "inspector:Preview*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics", "events:DescribeRule", "events:ListRuleNamesByTarget" ], "Resource": "*" } ] } } }, "createdDate": "2015-10-07T17:08:01.000Z", "lastUpdatedDate": "2019-10-01T15:17:54.000Z" }, "AmazonInspectorFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonInspectorFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2015-10-07T17:08:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:*", "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-03-09T04:06:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-09-12T17:42:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics", "events:DescribeRule", "events:ListRuleNamesByTarget" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-12-21T14:53:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics", "events:DescribeRule", "events:ListRuleNamesByTarget" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "inspector.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/inspector.amazonaws.com/AWSServiceRoleForAmazonInspector", "Condition": { "StringLike": { "iam:AWSServiceName": "inspector.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2017-11-01T18:20:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "inspector:*", "ec2:DescribeInstances", "ec2:DescribeTags", "sns:ListTopics", "events:DescribeRule", "events:ListRuleNamesByTarget" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/inspector.amazonaws.com/AWSServiceRoleForAmazonInspector", "Condition": { "StringLike": { "iam:AWSServiceName": "inspector.amazonaws.com" } } } ] } } }, "createdDate": "2015-10-07T17:08:04.000Z", "lastUpdatedDate": "2017-12-21T14:53:31.000Z" }, "AmazonKinesisFirehoseReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisFirehoseReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-10-07T18:43:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "firehose:Describe*", "firehose:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-10-07T18:43:39.000Z", "lastUpdatedDate": "2015-10-07T18:43:39.000Z" }, "AmazonKinesisFirehoseFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisFirehoseFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-10-07T18:45:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "firehose:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-10-07T18:45:26.000Z", "lastUpdatedDate": "2015-10-07T18:45:26.000Z" }, "AWSIoTRuleActions": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTRuleActions", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-10-08T15:14:51.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "dynamodb:PutItem", "kinesis:PutRecord", "iot:Publish", "s3:PutObject", "sns:Publish", "sqs:SendMessage*" ], "Resource": "*" } } }, "v2": { "createdDate": "2018-01-16T19:28:19.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "dynamodb:PutItem", "kinesis:PutRecord", "iot:Publish", "s3:PutObject", "sns:Publish", "sqs:SendMessage*", "cloudwatch:SetAlarmState", "cloudwatch:PutMetricData", "es:ESHttpPut", "firehose:PutRecord" ], "Resource": "*" } } } }, "createdDate": "2015-10-08T15:14:51.000Z", "lastUpdatedDate": "2018-01-16T19:28:19.000Z" }, "AWSIoTLogging": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTLogging", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-10-08T15:17:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutMetricFilter", "logs:PutRetentionPolicy", "logs:GetLogEvents", "logs:DeleteLogStream" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-10-08T15:17:25.000Z", "lastUpdatedDate": "2015-10-08T15:17:25.000Z" }, "AWSIoTFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2015-10-08T15:19:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-05-19T21:39:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:*", "iotjobsdata:*" ], "Resource": "*" } ] } } }, "createdDate": "2015-10-08T15:19:49.000Z", "lastUpdatedDate": "2022-05-19T21:39:11.000Z" }, "AWSIoTDataAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTDataAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-10-27T21:51:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:Connect", "iot:Publish", "iot:Subscribe", "iot:Receive", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-16T18:24:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:Connect", "iot:Publish", "iot:Subscribe", "iot:Receive", "iot:GetThingShadow", "iot:UpdateThingShadow", "iot:DeleteThingShadow" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-06-23T21:34:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:Connect", "iot:Publish", "iot:Subscribe", "iot:Receive", "iot:GetThingShadow", "iot:UpdateThingShadow", "iot:DeleteThingShadow", "iot:ListNamedShadowsForThing" ], "Resource": "*" } ] } } }, "createdDate": "2015-10-27T21:51:18.000Z", "lastUpdatedDate": "2021-06-23T21:34:47.000Z" }, "AWSIoTConfigAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTConfigAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2015-10-27T21:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CreateCertificateFromCsr", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateThing", "iot:CreateTopicRule", "iot:DeleteCertificate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteThing", "iot:DeleteTopicRule", "iot:DescribeCertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListPolicies", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules", "iot:RejectCertificateTransfer", "iot:ReplaceTopicRule", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:TransferCertificate", "iot:UpdateCertificate", "iot:UpdateThing" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-04-11T16:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CreateCertificateFromCsr", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateThing", "iot:CreateTopicRule", "iot:DeleteCertificate", "iot:DeleteCACertificate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteThing", "iot:DeleteTopicRule", "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCACertificates", "iot:ListCertificatesByCA", "iot:ListPolicies", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules", "iot:RegisterCertificate", "iot:RegisterCACertificate", "iot:RejectCertificateTransfer", "iot:ReplaceTopicRule", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:TransferCertificate", "iot:UpdateCertificate", "iot:UpdateCACertificate", "iot:UpdateThing" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-06-08T18:20:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CreateCertificateFromCsr", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateThing", "iot:CreateTopicRule", "iot:DeleteCertificate", "iot:DeleteCACertificate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteThing", "iot:DeleteTopicRule", "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCACertificates", "iot:ListCertificatesByCA", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules", "iot:RegisterCertificate", "iot:RegisterCACertificate", "iot:RejectCertificateTransfer", "iot:ReplaceTopicRule", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:TransferCertificate", "iot:UpdateCertificate", "iot:UpdateCACertificate", "iot:UpdateThing" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-11-29T18:33:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AddThingToThingGroup", "iot:AssociateTargetsWithJob", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CancelJob", "iot:ClearDefaultAuthorizer", "iot:CreateAuthorizer", "iot:CreateCertificateFromCsr", "iot:CreateJob", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteAuthorizer", "iot:DeleteCACertificate", "iot:DeleteCertificate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteRoleAlias", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeleteV2LoggingLevel", "iot:DeprecateThingType", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:DisableTopicRule", "iot:EnableTopicRule", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:RegisterCACertificate", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RejectCertificateTransfer", "iot:RemoveThingFromThingGroup", "iot:ReplaceTopicRule", "iot:SearchIndex", "iot:SetDefaultAuthorizer", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:SetV2LoggingLevel", "iot:SetV2LoggingOptions", "iot:StartThingRegistrationTask", "iot:StopThingRegistrationTask", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:TransferCertificate", "iot:UpdateAuthorizer", "iot:UpdateCACertificate", "iot:UpdateCertificate", "iot:UpdateCertificateTag", "iot:UpdateEventConfigurations", "iot:UpdateIndexingConfiguration", "iot:UpdateRoleAlias", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingGroupsForThing" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2017-12-20T20:37:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AddThingToThingGroup", "iot:AssociateTargetsWithJob", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CancelJob", "iot:ClearDefaultAuthorizer", "iot:CreateAuthorizer", "iot:CreateCertificateFromCsr", "iot:CreateJob", "iot:CreateKeysAndCertificate", "iot:CreateOTAUpdate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateRoleAlias", "iot:CreateStream", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteAuthorizer", "iot:DeleteCACertificate", "iot:DeleteCertificate", "iot:DeleteOTAUpdate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteRoleAlias", "iot:DeleteStream", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeleteV2LoggingLevel", "iot:DeprecateThingType", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:DisableTopicRule", "iot:EnableTopicRule", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:RegisterCACertificate", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RejectCertificateTransfer", "iot:RemoveThingFromThingGroup", "iot:ReplaceTopicRule", "iot:SearchIndex", "iot:SetDefaultAuthorizer", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:SetV2LoggingLevel", "iot:SetV2LoggingOptions", "iot:StartThingRegistrationTask", "iot:StopThingRegistrationTask", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:TransferCertificate", "iot:UpdateAuthorizer", "iot:UpdateCACertificate", "iot:UpdateCertificate", "iot:UpdateCertificateTag", "iot:UpdateEventConfigurations", "iot:UpdateIndexingConfiguration", "iot:UpdateRoleAlias", "iot:UpdateStream", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingGroupsForThing" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2016-07-27T20:41:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CreateCertificateFromCsr", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateThing", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteCertificate", "iot:DeleteCACertificate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteThing", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeprecateThingType", "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:DescribeThingType", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCACertificates", "iot:ListCertificatesByCA", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListThingTypes", "iot:ListTopicRules", "iot:RegisterCertificate", "iot:RegisterCACertificate", "iot:RejectCertificateTransfer", "iot:ReplaceTopicRule", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:TransferCertificate", "iot:UpdateCertificate", "iot:UpdateCACertificate", "iot:UpdateThing" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2018-10-01T17:22:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AddThingToThingGroup", "iot:AssociateTargetsWithJob", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CancelJob", "iot:CancelJobExecution", "iot:ClearDefaultAuthorizer", "iot:CreateAuthorizer", "iot:CreateCertificateFromCsr", "iot:CreateJob", "iot:CreateKeysAndCertificate", "iot:CreateOTAUpdate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateRoleAlias", "iot:CreateStream", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteAuthorizer", "iot:DeleteCACertificate", "iot:DeleteCertificate", "iot:DeleteJob", "iot:DeleteJobExecution", "iot:DeleteOTAUpdate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteRoleAlias", "iot:DeleteStream", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeleteV2LoggingLevel", "iot:DeprecateThingType", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:DisableTopicRule", "iot:EnableTopicRule", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:RegisterCACertificate", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RejectCertificateTransfer", "iot:RemoveThingFromThingGroup", "iot:ReplaceTopicRule", "iot:SearchIndex", "iot:SetDefaultAuthorizer", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:SetV2LoggingLevel", "iot:SetV2LoggingOptions", "iot:StartThingRegistrationTask", "iot:StopThingRegistrationTask", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:TransferCertificate", "iot:UpdateAuthorizer", "iot:UpdateCACertificate", "iot:UpdateCertificate", "iot:UpdateCertificateTag", "iot:UpdateEventConfigurations", "iot:UpdateIndexingConfiguration", "iot:UpdateRoleAlias", "iot:UpdateStream", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingGroupsForThing", "iot:UpdateAccountAuditConfiguration", "iot:DescribeAccountAuditConfiguration", "iot:DeleteAccountAuditConfiguration", "iot:StartOnDemandAuditTask", "iot:CancelAuditTask", "iot:DescribeAuditTask", "iot:ListAuditTasks", "iot:CreateScheduledAudit", "iot:UpdateScheduledAudit", "iot:DeleteScheduledAudit", "iot:DescribeScheduledAudit", "iot:ListScheduledAudits", "iot:ListAuditFindings", "iot:CreateSecurityProfile", "iot:DescribeSecurityProfile", "iot:UpdateSecurityProfile", "iot:DeleteSecurityProfile", "iot:AttachSecurityProfile", "iot:DetachSecurityProfile", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTargetsForSecurityProfile", "iot:ListActiveViolations", "iot:ListViolationEvents", "iot:ValidateSecurityProfileBehaviors" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2019-09-27T20:48:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AddThingToThingGroup", "iot:AssociateTargetsWithJob", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CancelJob", "iot:CancelJobExecution", "iot:ClearDefaultAuthorizer", "iot:CreateAuthorizer", "iot:CreateCertificateFromCsr", "iot:CreateJob", "iot:CreateKeysAndCertificate", "iot:CreateOTAUpdate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateRoleAlias", "iot:CreateStream", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteAuthorizer", "iot:DeleteCACertificate", "iot:DeleteCertificate", "iot:DeleteJob", "iot:DeleteJobExecution", "iot:DeleteOTAUpdate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteRoleAlias", "iot:DeleteStream", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeleteV2LoggingLevel", "iot:DeprecateThingType", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:DisableTopicRule", "iot:EnableTopicRule", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:RegisterCACertificate", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RejectCertificateTransfer", "iot:RemoveThingFromThingGroup", "iot:ReplaceTopicRule", "iot:SearchIndex", "iot:SetDefaultAuthorizer", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:SetV2LoggingLevel", "iot:SetV2LoggingOptions", "iot:StartThingRegistrationTask", "iot:StopThingRegistrationTask", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:TransferCertificate", "iot:UpdateAuthorizer", "iot:UpdateCACertificate", "iot:UpdateCertificate", "iot:UpdateEventConfigurations", "iot:UpdateIndexingConfiguration", "iot:UpdateRoleAlias", "iot:UpdateStream", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingGroupsForThing", "iot:UpdateAccountAuditConfiguration", "iot:DescribeAccountAuditConfiguration", "iot:DeleteAccountAuditConfiguration", "iot:StartOnDemandAuditTask", "iot:CancelAuditTask", "iot:DescribeAuditTask", "iot:ListAuditTasks", "iot:CreateScheduledAudit", "iot:UpdateScheduledAudit", "iot:DeleteScheduledAudit", "iot:DescribeScheduledAudit", "iot:ListScheduledAudits", "iot:ListAuditFindings", "iot:CreateSecurityProfile", "iot:DescribeSecurityProfile", "iot:UpdateSecurityProfile", "iot:DeleteSecurityProfile", "iot:AttachSecurityProfile", "iot:DetachSecurityProfile", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTargetsForSecurityProfile", "iot:ListActiveViolations", "iot:ListViolationEvents", "iot:ValidateSecurityProfileBehaviors" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2018-07-18T21:17:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AcceptCertificateTransfer", "iot:AddThingToThingGroup", "iot:AssociateTargetsWithJob", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CancelCertificateTransfer", "iot:CancelJob", "iot:ClearDefaultAuthorizer", "iot:CreateAuthorizer", "iot:CreateCertificateFromCsr", "iot:CreateJob", "iot:CreateKeysAndCertificate", "iot:CreateOTAUpdate", "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:CreateRoleAlias", "iot:CreateStream", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:CreateTopicRule", "iot:DeleteAuthorizer", "iot:DeleteCACertificate", "iot:DeleteCertificate", "iot:DeleteOTAUpdate", "iot:DeletePolicy", "iot:DeletePolicyVersion", "iot:DeleteRegistrationCode", "iot:DeleteRoleAlias", "iot:DeleteStream", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeleteTopicRule", "iot:DeleteV2LoggingLevel", "iot:DeprecateThingType", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachPrincipalPolicy", "iot:DetachThingPrincipal", "iot:DisableTopicRule", "iot:EnableTopicRule", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:RegisterCACertificate", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RejectCertificateTransfer", "iot:RemoveThingFromThingGroup", "iot:ReplaceTopicRule", "iot:SearchIndex", "iot:SetDefaultAuthorizer", "iot:SetDefaultPolicyVersion", "iot:SetLoggingOptions", "iot:SetV2LoggingLevel", "iot:SetV2LoggingOptions", "iot:StartThingRegistrationTask", "iot:StopThingRegistrationTask", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:TransferCertificate", "iot:UpdateAuthorizer", "iot:UpdateCACertificate", "iot:UpdateCertificate", "iot:UpdateCertificateTag", "iot:UpdateEventConfigurations", "iot:UpdateIndexingConfiguration", "iot:UpdateRoleAlias", "iot:UpdateStream", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingGroupsForThing", "iot:UpdateAccountAuditConfiguration", "iot:DescribeAccountAuditConfiguration", "iot:DeleteAccountAuditConfiguration", "iot:StartOnDemandAuditTask", "iot:CancelAuditTask", "iot:DescribeAuditTask", "iot:ListAuditTasks", "iot:CreateScheduledAudit", "iot:UpdateScheduledAudit", "iot:DeleteScheduledAudit", "iot:DescribeScheduledAudit", "iot:ListScheduledAudits", "iot:ListAuditFindings", "iot:CreateSecurityProfile", "iot:DescribeSecurityProfile", "iot:UpdateSecurityProfile", "iot:DeleteSecurityProfile", "iot:AttachSecurityProfile", "iot:DetachSecurityProfile", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTargetsForSecurityProfile", "iot:ListActiveViolations", "iot:ListViolationEvents", "iot:ValidateSecurityProfileBehaviors" ], "Resource": "*" } ] } } }, "createdDate": "2015-10-27T21:52:07.000Z", "lastUpdatedDate": "2019-09-27T20:48:00.000Z" }, "AWSIoTConfigReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTConfigReadOnlyAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2015-10-27T21:52:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeCertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListPolicies", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-04-11T16:31:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListCACertificates", "iot:ListPolicies", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-06-08T18:21:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListCACertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListTopicRules" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2016-07-27T20:41:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeCertificate", "iot:DescribeCACertificate", "iot:DescribeEndpoint", "iot:DescribeThing", "iot:DescribeThingType", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListCACertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListThingTypes", "iot:ListTopicRules" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-11-29T18:34:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:SearchIndex", "iot:TestAuthorization", "iot:TestInvokeAuthorizer" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2017-12-20T20:38:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:SearchIndex", "iot:TestAuthorization", "iot:TestInvokeAuthorizer" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2018-07-18T21:22:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCertificateTag", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:SearchIndex", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuditTask", "iot:ListAuditTasks", "iot:DescribeScheduledAudit", "iot:ListScheduledAudits", "iot:ListAuditFindings", "iot:DescribeSecurityProfile", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTargetsForSecurityProfile", "iot:ListActiveViolations", "iot:ListViolationEvents", "iot:ValidateSecurityProfileBehaviors" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-09-27T20:52:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeDefaultAuthorizer", "iot:DescribeEndpoint", "iot:DescribeEventConfigurations", "iot:DescribeIndex", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DescribeRoleAlias", "iot:DescribeStream", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingRegistrationTask", "iot:DescribeThingType", "iot:GetEffectivePolicies", "iot:GetIndexingConfiguration", "iot:GetJobDocument", "iot:GetLoggingOptions", "iot:GetOTAUpdate", "iot:GetPolicy", "iot:GetPolicyVersion", "iot:GetRegistrationCode", "iot:GetTopicRule", "iot:GetV2LoggingOptions", "iot:ListAttachedPolicies", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCertificatesByCA", "iot:ListIndices", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:ListJobs", "iot:ListOTAUpdates", "iot:ListOutgoingCertificates", "iot:ListPolicies", "iot:ListPolicyPrincipals", "iot:ListPolicyVersions", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListRoleAliases", "iot:ListStreams", "iot:ListTargetsForPolicy", "iot:ListThingGroups", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThingRegistrationTaskReports", "iot:ListThingRegistrationTasks", "iot:ListThings", "iot:ListThingsInThingGroup", "iot:ListThingTypes", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:SearchIndex", "iot:TestAuthorization", "iot:TestInvokeAuthorizer", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuditTask", "iot:ListAuditTasks", "iot:DescribeScheduledAudit", "iot:ListScheduledAudits", "iot:ListAuditFindings", "iot:DescribeSecurityProfile", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTargetsForSecurityProfile", "iot:ListActiveViolations", "iot:ListViolationEvents", "iot:ValidateSecurityProfileBehaviors" ], "Resource": "*" } ] } } }, "createdDate": "2015-10-27T21:52:31.000Z", "lastUpdatedDate": "2019-09-27T20:52:40.000Z" }, "AWSQuickSightDescribeRDS": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightDescribeRDS", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-11-10T23:24:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-11-10T23:24:50.000Z", "lastUpdatedDate": "2015-11-10T23:24:50.000Z" }, "AWSQuickSightDescribeRedshift": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightDescribeRedshift", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-11-10T23:25:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "redshift:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2015-11-10T23:25:01.000Z", "lastUpdatedDate": "2015-11-10T23:25:01.000Z" }, "AWSQuickSightListIAM": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightListIAM", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-11-10T23:25:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:List*" ], "Resource": "*" } ] } } }, "createdDate": "2015-11-10T23:25:07.000Z", "lastUpdatedDate": "2015-11-10T23:25:07.000Z" }, "AmazonRDSEnhancedMonitoringRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-11-11T19:58:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:RDS*" ] }, { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:RDS*:log-stream:*" ] } ] } } }, "createdDate": "2015-11-11T19:58:29.000Z", "lastUpdatedDate": "2015-11-11T19:58:29.000Z" }, "AmazonAPIGatewayPushToCloudWatchLogs": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-11-11T23:41:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2015-11-11T23:41:46.000Z", "lastUpdatedDate": "2015-11-11T23:41:46.000Z" }, "AmazonDMSVPCManagementRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2015-11-18T16:33:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2015-12-17T21:09:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-05-23T16:29:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2015-11-18T16:33:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" } ] } } }, "createdDate": "2015-11-18T16:33:19.000Z", "lastUpdatedDate": "2024-07-25T15:19:01.000Z" }, "AmazonMechanicalTurkFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMechanicalTurkFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2015-12-11T19:08:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mechanicalturk:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-12-11T19:08:19.000Z", "lastUpdatedDate": "2015-12-11T19:08:19.000Z" }, "AmazonMechanicalTurkReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonMechanicalTurkReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-12-11T19:08:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mechanicalturk:Get*", "mechanicalturk:Search*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-02-27T21:45:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mechanicalturk:Get*", "mechanicalturk:Search*", "mechanicalturk:List*" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-09-25T21:06:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mechanicalturk:Get*", "mechanicalturk:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2015-12-11T19:08:28.000Z", "lastUpdatedDate": "2019-09-25T21:06:26.000Z" }, "AmazonEC2ContainerRegistryReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-12-21T17:04:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-10-11T22:08:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-12-10T20:56:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:GetLifecyclePolicy", "ecr:GetLifecyclePolicyPreview", "ecr:ListTagsForResource", "ecr:DescribeImageScanFindings" ], "Resource": "*" } ] } } }, "createdDate": "2015-12-21T17:04:15.000Z", "lastUpdatedDate": "2019-12-10T20:56:32.000Z" }, "AmazonEC2ContainerRegistryPowerUser": { "arn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-12-21T17:05:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-12-10T20:48:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:GetLifecyclePolicy", "ecr:GetLifecyclePolicyPreview", "ecr:ListTagsForResource", "ecr:DescribeImageScanFindings", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-10-11T22:28:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" } ] } } }, "createdDate": "2015-12-21T17:05:33.000Z", "lastUpdatedDate": "2019-12-10T20:48:08.000Z" }, "AmazonEC2ContainerRegistryFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2015-12-21T17:06:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-10T17:54:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:*", "cloudtrail:LookupEvents" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-05T00:04:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:*", "cloudtrail:LookupEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "replication.ecr.amazonaws.com" ] } } } ] } } }, "createdDate": "2015-12-21T17:06:48.000Z", "lastUpdatedDate": "2020-12-05T00:04:19.000Z" }, "AWSMobileHub_ReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSMobileHub_ReadOnly", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2016-01-05T19:55:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "sns:ListTopics", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v2": { "createdDate": "2016-03-09T19:44:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v3": { "createdDate": "2016-11-21T06:05:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v5": { "createdDate": "2017-03-27T21:31:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v4": { "createdDate": "2016-11-30T17:19:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v7": { "createdDate": "2017-07-06T21:43:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:ExportProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v8": { "createdDate": "2017-08-10T22:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:ExportProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v6": { "createdDate": "2017-04-05T17:31:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:ExportProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v9": { "createdDate": "2018-02-05T23:24:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:ExportProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListProjectSnapshots", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v10": { "createdDate": "2018-07-23T21:59:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:ExportProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:SynchronizeProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListProjectSnapshots", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } } }, "createdDate": "2016-01-05T19:55:48.000Z", "lastUpdatedDate": "2018-07-23T21:59:05.000Z" }, "AWSMobileHub_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMobileHub_FullAccess", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v2": { "createdDate": "2016-03-09T19:43:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v1": { "createdDate": "2016-01-05T19:56:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "sns:ListTopics", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v3": { "createdDate": "2016-08-12T17:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v4": { "createdDate": "2016-11-04T17:16:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v5": { "createdDate": "2016-11-04T23:05:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "lambda:ListFunctions", "sns:ListTopics", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v6": { "createdDate": "2016-11-30T17:26:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v8": { "createdDate": "2017-04-05T17:44:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v7": { "createdDate": "2017-03-27T21:31:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v10": { "createdDate": "2017-08-10T22:23:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v9": { "createdDate": "2017-07-06T21:55:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" } ] } }, "v12": { "createdDate": "2017-11-14T22:48:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "cloudfront:GetDistribution", "devicefarm:CreateProject", "devicefarm:ListJobs", "devicefarm:ListRuns", "devicefarm:GetProject", "devicefarm:GetRun", "devicefarm:ListArtifacts", "devicefarm:ListProjects", "devicefarm:ScheduleRun", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::*-mobilehub-*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*-mobilehub-*" } ] } }, "v13": { "createdDate": "2018-02-05T23:44:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "cloudfront:GetDistribution", "devicefarm:CreateProject", "devicefarm:ListJobs", "devicefarm:ListRuns", "devicefarm:GetProject", "devicefarm:GetRun", "devicefarm:ListArtifacts", "devicefarm:ListProjects", "devicefarm:ScheduleRun", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListProjectSnapshots", "mobilehub:DeleteProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::*-mobilehub-*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*-mobilehub-*" } ] } }, "v11": { "createdDate": "2017-10-16T19:07:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:GetRestApis", "apigateway:GetResources", "apigateway:POST", "apigateway:TestInvokeMethod", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:CreateProject", "mobilehub:DeleteProject", "mobilehub:UpdateProject", "mobilehub:ExportProject", "mobilehub:ImportProject", "mobilehub:SynchronizeProject", "mobilehub:GenerateProjectParameters", "mobilehub:GetProject", "mobilehub:GetProjectSnapshot", "mobilehub:ListAvailableConnectors", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "mobilehub:DescribeBundle", "mobilehub:ExportBundle", "mobilehub:ListBundles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::*-mobilehub-*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*-mobilehub-*" } ] } }, "v14": { "createdDate": "2019-12-19T23:15:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "cloudfront:GetDistribution", "devicefarm:CreateProject", "devicefarm:ListJobs", "devicefarm:ListRuns", "devicefarm:GetProject", "devicefarm:GetRun", "devicefarm:ListArtifacts", "devicefarm:ListProjects", "devicefarm:ScheduleRun", "dynamodb:DescribeTable", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListSAMLProviders", "lambda:ListFunctions", "sns:ListTopics", "lex:GetIntent", "lex:GetIntents", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetBot", "lex:GetBots", "lex:GetBotAlias", "lex:GetBotAliases", "mobilehub:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/aws-my-sample-app*.zip" }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::*-mobilehub-*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*-mobilehub-*" } ] } } }, "createdDate": "2016-01-05T19:56:01.000Z", "lastUpdatedDate": "2019-12-19T23:15:52.000Z" }, "AmazonDMSCloudWatchLogsRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-01-07T23:44:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDescribeOnAllLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeOfAllLogStreamsOnDmsTasksLogGroup", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*" ] }, { "Sid": "AllowCreationOfDmsTasksLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*" ] }, { "Sid": "AllowCreationOfDmsTaskLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*:log-stream:dms-task-*" ] }, { "Sid": "AllowUploadOfLogEventsToDmsTaskLogStream", "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*:log-stream:dms-task-*" ] } ] } }, "v2": { "createdDate": "2023-05-23T21:32:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDescribeOnAllLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeOfAllLogStreamsOnDmsTasksLogGroup", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*", "arn:aws:logs:*:*:log-group:dms-serverless-replication-*" ] }, { "Sid": "AllowCreationOfDmsLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*", "arn:aws:logs:*:*:log-group:dms-serverless-replication-*:log-stream:" ] }, { "Sid": "AllowCreationOfDmsLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*:log-stream:dms-task-*", "arn:aws:logs:*:*:log-group:dms-serverless-replication-*:log-stream:dms-serverless-*" ] }, { "Sid": "AllowUploadOfLogEventsToDmsLogStream", "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:dms-tasks-*:log-stream:dms-task-*", "arn:aws:logs:*:*:log-group:dms-serverless-replication-*:log-stream:dms-serverless-*" ] } ] } } }, "createdDate": "2016-01-07T23:44:53.000Z", "lastUpdatedDate": "2023-05-23T21:32:57.000Z" }, "CloudWatchEventsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchEventsReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-01-14T18:27:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEventsReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-08-10T17:25:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEventsReadOnlyAccess", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeEventBus" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-12-01T16:29:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays", "events:DescribeConnection", "events:ListConnections", "events:DescribeApiDestination", "events:ListApiDestinations", "events:DescribeEndpoint", "events:ListEndpoints", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ExportSchema", "schemas:GetCodeBindingSource", "schemas:GetDiscoveredSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "schemas:SearchSchemas", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListSchedules", "scheduler:ListScheduleGroups", "scheduler:ListTagsForResource", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2016-01-14T18:27:18.000Z", "lastUpdatedDate": "2022-12-01T16:29:31.000Z" }, "CloudWatchEventsBuiltInTargetExecutionAccess": { "arn": "arn:aws:iam::aws:policy/service-role/CloudWatchEventsBuiltInTargetExecutionAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-01-14T18:35:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEventsBuiltInTargetExecutionAccess", "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:RebootInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:CreateSnapshot" ], "Resource": "*" } ] } } }, "createdDate": "2016-01-14T18:35:49.000Z", "lastUpdatedDate": "2016-01-14T18:35:49.000Z" }, "CloudWatchEventsInvocationAccess": { "arn": "arn:aws:iam::aws:policy/service-role/CloudWatchEventsInvocationAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-01-14T18:36:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEventsInvocationAccess", "Effect": "Allow", "Action": [ "kinesis:PutRecord" ], "Resource": "*" } ] } } }, "createdDate": "2016-01-14T18:36:33.000Z", "lastUpdatedDate": "2016-01-14T18:36:33.000Z" }, "CloudWatchEventsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-01-14T18:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEventsFullAccess", "Effect": "Allow", "Action": "events:*", "Resource": "*" }, { "Sid": "IAMPassRoleForCloudWatchEvents", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS_Events_Invoke_Targets" } ] } }, "v2": { "createdDate": "2022-12-01T17:05:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgeActions", "Effect": "Allow", "Action": [ "events:*", "schemas:*", "scheduler:*", "pipes:*" ], "Resource": "*" }, { "Sid": "IAMCreateServiceLinkedRoleForApiDestinations", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas", "Condition": { "StringEquals": { "iam:AWSServiceName": "schemas.amazonaws.com" } } }, { "Sid": "SecretsManagerAccessForApiDestinations", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Sid": "IAMPassRoleForCloudWatchEvents", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS_Events_Invoke_Targets" }, { "Sid": "IAMPassRoleAccessForScheduler", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "scheduler.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForPipes", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "pipes.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2016-01-14T18:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgeActions", "Effect": "Allow", "Action": [ "events:*", "schemas:*", "scheduler:*", "pipes:*" ], "Resource": "*" }, { "Sid": "IAMCreateServiceLinkedRoleForApiDestinations", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas", "Condition": { "StringEquals": { "iam:AWSServiceName": "schemas.amazonaws.com" } } }, { "Sid": "SecretsManagerAccessForApiDestinations", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Sid": "IAMPassRoleForCloudWatchEvents", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS_Events_Invoke_Targets" }, { "Sid": "IAMPassRoleAccessForScheduler", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "scheduler.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForPipes", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "pipes.amazonaws.com" } } } ] } } }, "createdDate": "2016-01-14T18:37:08.000Z", "lastUpdatedDate": "2025-01-22T02:07:06.000Z" }, "AWSCertificateManagerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-01-21T17:02:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-08-17T22:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/acm.amazonaws.com/AWSServiceRoleForCertificateManager*", "Condition": { "StringEquals": { "iam:AWSServiceName": "acm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/acm.amazonaws.com/AWSServiceRoleForCertificateManager*" } ] } } }, "createdDate": "2016-01-21T17:02:36.000Z", "lastUpdatedDate": "2020-08-17T22:18:28.000Z" }, "AWSCertificateManagerReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2016-01-21T17:07:33.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate" ], "Resource": "*" } } }, "v2": { "createdDate": "2016-04-21T15:08:16.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", "acm:ListTagsForCertificate" ], "Resource": "*" } } }, "v3": { "createdDate": "2021-03-03T23:52:21.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", "acm:ListTagsForCertificate", "acm:GetAcccountConfiguration" ], "Resource": "*" } } }, "v4": { "createdDate": "2021-03-15T16:25:21.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", "acm:ListTagsForCertificate", "acm:GetAccountConfiguration" ], "Resource": "*" } } } }, "createdDate": "2016-01-21T17:07:33.000Z", "lastUpdatedDate": "2021-03-15T16:25:21.000Z" }, "AWSElasticBeanstalkWebTier": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2016-02-08T23:08:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*/*" ] } ] } }, "v3": { "createdDate": "2016-12-09T18:31:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2016-03-07T23:35:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] } ] } }, "v4": { "createdDate": "2016-12-21T02:06:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] } ] } }, "v5": { "createdDate": "2017-12-19T21:52:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] } ] } }, "v6": { "createdDate": "2019-03-01T00:04:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] } ] } }, "v7": { "createdDate": "2020-09-09T19:38:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "ElasticBeanstalkHealthAccess", "Action": [ "elasticbeanstalk:PutInstanceStatistics" ], "Effect": "Allow", "Resource": [ "arn:aws:elasticbeanstalk:*:*:application/*", "arn:aws:elasticbeanstalk:*:*:environment/*" ] } ] } } }, "createdDate": "2016-02-08T23:08:54.000Z", "lastUpdatedDate": "2020-09-09T19:38:36.000Z" }, "AWSElasticBeanstalkWorkerTier": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2016-02-08T23:12:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] } ] } }, "v2": { "createdDate": "2016-03-07T23:38:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] } ] } }, "v3": { "createdDate": "2016-12-09T18:29:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] } ] } }, "v4": { "createdDate": "2016-12-21T02:01:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] } ] } }, "v5": { "createdDate": "2019-03-01T00:07:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] } ] } }, "v6": { "createdDate": "2020-09-09T19:53:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MetricsAccess", "Action": [ "cloudwatch:PutMetricData" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "XRayAccess", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "QueueAccess", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "DynamoPeriodicTasks", "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": [ "arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*" ] }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "ElasticBeanstalkHealthAccess", "Action": [ "elasticbeanstalk:PutInstanceStatistics" ], "Effect": "Allow", "Resource": [ "arn:aws:elasticbeanstalk:*:*:application/*", "arn:aws:elasticbeanstalk:*:*:environment/*" ] } ] } } }, "createdDate": "2016-02-08T23:12:02.000Z", "lastUpdatedDate": "2020-09-09T19:53:40.000Z" }, "AWSElasticBeanstalkMulticontainerDocker": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-02-08T23:15:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSAccess", "Effect": "Allow", "Action": [ "ecs:Poll", "ecs:StartTask", "ecs:StopTask", "ecs:DiscoverPollEndpoint", "ecs:StartTelemetrySession", "ecs:RegisterContainerInstance", "ecs:DeregisterContainerInstance", "ecs:DescribeContainerInstances", "ecs:Submit*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-03-23T22:04:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSAccess", "Effect": "Allow", "Action": [ "ecs:Poll", "ecs:StartTask", "ecs:StopTask", "ecs:DiscoverPollEndpoint", "ecs:StartTelemetrySession", "ecs:RegisterContainerInstance", "ecs:DeregisterContainerInstance", "ecs:DescribeContainerInstances", "ecs:Submit*", "ecs:DescribeTasks" ], "Resource": "*" }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "RegisterContainerInstance", "StartTask" ] } } } ] } }, "v2": { "createdDate": "2016-06-06T23:45:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSAccess", "Effect": "Allow", "Action": [ "ecs:Poll", "ecs:StartTask", "ecs:StopTask", "ecs:DiscoverPollEndpoint", "ecs:StartTelemetrySession", "ecs:RegisterContainerInstance", "ecs:DeregisterContainerInstance", "ecs:DescribeContainerInstances", "ecs:Submit*", "ecs:DescribeTasks" ], "Resource": "*" } ] } } }, "createdDate": "2016-02-08T23:15:29.000Z", "lastUpdatedDate": "2023-03-23T22:04:20.000Z" }, "AWSElasticBeanstalkEnhancedHealth": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2016-08-22T20:28:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:GetConsoleOutput", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeSecurityGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeNotificationConfigurations" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2016-02-08T23:17:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeInstanceHealth", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:GetConsoleOutput", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeSecurityGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeNotificationConfigurations" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-03-01T22:59:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:GetConsoleOutput", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeSecurityGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeNotificationConfigurations", "sns:Publish" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2018-04-09T22:12:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:GetConsoleOutput", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeSecurityGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeNotificationConfigurations", "sns:Publish" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*:log-stream:*" } ] } } }, "createdDate": "2016-02-08T23:17:27.000Z", "lastUpdatedDate": "2018-04-09T22:12:53.000Z" }, "AWSLambdaVPCAccessExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2020-10-15T22:53:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2016-02-11T23:15:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2016-02-11T23:15:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSLambdaVPCAccessExecutionPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" } ] } } }, "createdDate": "2016-02-11T23:15:26.000Z", "lastUpdatedDate": "2024-01-05T22:38:26.000Z" }, "AmazonRDSDirectoryServiceAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-02-26T02:02:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-15T16:51:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:GetAuthorizedApplicationDetails" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2016-02-26T02:02:05.000Z", "lastUpdatedDate": "2019-05-15T16:51:50.000Z" }, "AWSMarketplaceMeteringFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-03-17T22:39:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:MeterUsage" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2016-03-17T22:39:22.000Z", "lastUpdatedDate": "2016-03-17T22:39:22.000Z" }, "AWSConfigRulesExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-03-25T17:59:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/AWSLogs/*/Config/*" }, { "Effect": "Allow", "Action": [ "config:Put*", "config:Get*", "config:List*", "config:Describe*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-12-20T22:16:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/AWSLogs/*/Config/*" }, { "Effect": "Allow", "Action": [ "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-05-13T21:33:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/AWSLogs/*/Config/*" }, { "Effect": "Allow", "Action": [ "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "config:Select*" ], "Resource": "*" } ] } } }, "createdDate": "2016-03-25T17:59:36.000Z", "lastUpdatedDate": "2019-05-13T21:33:30.000Z" }, "AWSElasticBeanstalkService": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkService", "latestVersionId": "v17", "versionsCount": 17, "versions": { "v1": { "createdDate": "2016-04-11T20:27:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:GetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2016-05-06T19:12:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2016-04-22T17:08:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2016-05-13T00:07:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2016-11-09T19:23:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2016-09-22T22:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2016-12-01T19:09:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2016-12-21T01:55:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2017-03-23T23:17:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2017-02-22T21:12:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2017-06-21T16:49:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v12": { "createdDate": "2018-03-10T00:02:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v14": { "createdDate": "2019-01-11T22:19:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v13": { "createdDate": "2018-04-19T16:34:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v15": { "createdDate": "2019-02-05T17:46:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:CopyObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectMetadata", "s3:ListBucket", "s3:listBuckets", "s3:ListObjects", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v16": { "createdDate": "2019-06-14T23:18:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:GetObject", "s3:GetObjectAcl", "s3:ListBucket", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v17": { "createdDate": "2023-05-10T19:29:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "AllowELBAddTags", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags" ], "Resource": "*", "Condition": { "StringEquals": { "elasticloadbalancing:CreateAction": [ "CreateLoadBalancer" ] } } }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstanceAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcClassicLink", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "iam:PassRole", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "s3:GetObject", "s3:GetObjectAcl", "s3:ListBucket", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:SetTopicAttributes", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-04-11T20:27:23.000Z", "lastUpdatedDate": "2023-05-10T19:29:34.000Z" }, "AmazonDMSRedshiftS3Role": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-04-20T17:05:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:DeleteBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:DeleteBucketPolicy" ], "Resource": "arn:aws:s3:::dms-*" } ] } }, "v3": { "createdDate": "2019-07-08T18:19:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:DeleteBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketAcl", "s3:PutBucketVersioning", "s3:GetBucketVersioning", "s3:PutLifecycleConfiguration", "s3:GetLifecycleConfiguration", "s3:DeleteBucketPolicy" ], "Resource": "arn:aws:s3:::dms-*" } ] } }, "v2": { "createdDate": "2019-06-12T18:50:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:DeleteBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketAcl", "s3:DeleteBucketPolicy" ], "Resource": "arn:aws:s3:::dms-*" } ] } } }, "createdDate": "2016-04-20T17:05:56.000Z", "lastUpdatedDate": "2019-07-08T18:19:14.000Z" }, "AWSApplicationDiscoveryServiceFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationDiscoveryServiceFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2016-05-11T21:30:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "discovery:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-01-16T21:35:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2019-06-19T21:21:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*", "Condition": { "StringEquals": { "iam:AWSServiceName": "continuousexport.discovery.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "migrationhub.amazonaws.com", "dmsintegration.migrationhub.amazonaws.com", "smsintegration.migrationhub.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2018-08-16T16:02:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*", "Condition": { "StringEquals": { "iam:AWSServiceName": "continuousexport.discovery.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*" } ] } } }, "createdDate": "2016-05-11T21:30:50.000Z", "lastUpdatedDate": "2019-06-19T21:21:26.000Z" }, "AWSApplicationDiscoveryAgentAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationDiscoveryAgentAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2020-02-24T22:26:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "arsenal:RegisterOnPremisesAgent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:GetHomeRegion" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2016-05-11T21:38:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "arsenal:RegisterOnPremisesAgent" ], "Resource": "*" } ] } } }, "createdDate": "2016-05-11T21:38:47.000Z", "lastUpdatedDate": "2020-02-24T22:26:45.000Z" }, "AmazonEC2ContainerServiceAutoscaleRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-05-12T23:25:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeServices", "ecs:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-02-05T19:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeServices", "ecs:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-05-12T23:25:44.000Z", "lastUpdatedDate": "2018-02-05T19:15:15.000Z" }, "AWSOpsWorksInstanceRegistration": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorksInstanceRegistration", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-06-03T14:23:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "opsworks:DescribeStackProvisioningParameters", "opsworks:DescribeStacks", "opsworks:RegisterInstance" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-06-03T14:23:15.000Z", "lastUpdatedDate": "2016-06-03T14:23:15.000Z" }, "AWSCodePipelineApproverAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodePipelineApproverAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2016-11-03T23:31:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:GetPipelineExecution", "codepipeline:ListPipelines", "codepipeline:PutApprovalResult" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-08-02T17:24:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:GetPipelineExecution", "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codepipeline:PutApprovalResult" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2016-07-28T18:59:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "codepipeline:PutApprovalResult" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2016-07-28T18:59:17.000Z", "lastUpdatedDate": "2017-08-02T17:24:58.000Z" }, "AWSAgentlessDiscoveryService": { "arn": "arn:aws:iam::aws:policy/AWSAgentlessDiscoveryService", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-08-02T01:35:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "awsconnector:RegisterConnector", "awsconnector:GetConnectorHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::connector-platform-upgrade-info/*", "arn:aws:s3:::connector-platform-upgrade-info", "arn:aws:s3:::connector-platform-upgrade-bundles/*", "arn:aws:s3:::connector-platform-upgrade-bundles", "arn:aws:s3:::connector-platform-release-notes/*", "arn:aws:s3:::connector-platform-release-notes", "arn:aws:s3:::prod.agentless.discovery.connector.upgrade/*", "arn:aws:s3:::prod.agentless.discovery.connector.upgrade" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::import-to-ec2-connector-debug-logs/*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" }, { "Sid": "Discovery", "Effect": "Allow", "Action": [ "Discovery:*" ], "Resource": "*" }, { "Sid": "arsenal", "Effect": "Allow", "Action": [ "arsenal:RegisterOnPremisesAgent" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-02-24T23:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "awsconnector:RegisterConnector", "awsconnector:GetConnectorHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::connector-platform-upgrade-info/*", "arn:aws:s3:::connector-platform-upgrade-info", "arn:aws:s3:::connector-platform-upgrade-bundles/*", "arn:aws:s3:::connector-platform-upgrade-bundles", "arn:aws:s3:::connector-platform-release-notes/*", "arn:aws:s3:::connector-platform-release-notes", "arn:aws:s3:::prod.agentless.discovery.connector.upgrade/*", "arn:aws:s3:::prod.agentless.discovery.connector.upgrade" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::import-to-ec2-connector-debug-logs/*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" }, { "Sid": "Discovery", "Effect": "Allow", "Action": [ "Discovery:*" ], "Resource": "*" }, { "Sid": "arsenal", "Effect": "Allow", "Action": [ "arsenal:RegisterOnPremisesAgent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:GetHomeRegion" ], "Resource": "*" } ] } } }, "createdDate": "2016-08-02T01:35:11.000Z", "lastUpdatedDate": "2020-02-24T23:08:23.000Z" }, "AmazonEC2SpotFleetAutoscaleRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetAutoscaleRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-08-19T18:27:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSpotFleetRequests", "ec2:ModifySpotFleetRequest" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-11-14T22:24:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSpotFleetRequests", "ec2:ModifySpotFleetRequest" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-02-18T19:17:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSpotFleetRequests", "ec2:ModifySpotFleetRequest" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/ec2.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_EC2SpotFleetRequest", "Condition": { "StringLike": { "iam:AWSServiceName": "ec2.application-autoscaling.amazonaws.com" } } } ] } } }, "createdDate": "2016-08-19T18:27:22.000Z", "lastUpdatedDate": "2019-02-18T19:17:03.000Z" }, "AmazonKinesisAnalyticsReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisAnalyticsReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-09-21T18:16:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesisanalytics:Describe*", "kinesisanalytics:Get*", "kinesisanalytics:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:ListStreams" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLogEvents", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListPolicyVersions", "iam:ListRoles" ], "Resource": "*" } ] } } }, "createdDate": "2016-09-21T18:16:43.000Z", "lastUpdatedDate": "2016-09-21T18:16:43.000Z" }, "AmazonKinesisAnalyticsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisAnalyticsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-09-21T19:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kinesisanalytics:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:ListStreams", "kinesis:PutRecord", "kinesis:PutRecords" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLogEvents", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListPolicyVersions", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/kinesis-analytics*" } ] } } }, "createdDate": "2016-09-21T19:01:14.000Z", "lastUpdatedDate": "2016-09-21T19:01:14.000Z" }, "ServerMigrationConnector": { "arn": "arn:aws:iam::aws:policy/ServerMigrationConnector", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-10-24T21:45:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:GetUser", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sms:SendMessage", "sms:GetMessages" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::sms-b-*", "arn:aws:s3:::import-to-ec2-*", "arn:aws:s3:::server-migration-service-upgrade", "arn:aws:s3:::server-migration-service-upgrade/*", "arn:aws:s3:::connector-platform-upgrade-info/*", "arn:aws:s3:::connector-platform-upgrade-info", "arn:aws:s3:::connector-platform-upgrade-bundles/*", "arn:aws:s3:::connector-platform-upgrade-bundles", "arn:aws:s3:::connector-platform-release-notes/*", "arn:aws:s3:::connector-platform-release-notes" ] }, { "Effect": "Allow", "Action": "awsconnector:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": "arn:aws:sns:*:*:metrics-sns-topic-for-*" } ] } } }, "createdDate": "2016-10-24T21:45:56.000Z", "lastUpdatedDate": "2016-10-24T21:45:56.000Z" }, "ViewOnlyAccess": { "arn": "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess", "latestVersionId": "v23", "versionsCount": 23, "versions": { "v2": { "createdDate": "2016-12-09T22:20:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:GetMetricData", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:List*", "ses:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:GetMetricData", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2: DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "logs:Describe*", "machinelearning:Describe*", "opsworks:Describe*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:List*", "ses:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-02-06T22:35:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:GetMetricData", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2018-09-12T21:57:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-06-26T22:35:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:GetMetricData", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2018-05-16T20:35:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:GetMetricData", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:ListTables", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2018-10-15T18:34:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:DescribeTable", "dax:ListTables", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2020-01-16T17:42:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2020-03-09T23:53:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v11": { "createdDate": "2021-06-11T19:27:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v12": { "createdDate": "2021-12-21T02:53:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:DescribeCarrierGateways", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v10": { "createdDate": "2020-08-18T22:51:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "codestar:Verify*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v13": { "createdDate": "2022-04-12T19:26:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "aws-marketplace:ViewSubscriptions", "autoscaling:Describe*", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:List*", "cloudformation:DescribeStacks", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListLunaClients", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudsearch:List*", "cloudsearch:DescribeDomains", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:List*", "cloudwatch:Get*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:List*", "codedeploy:Get*", "codepipeline:ListPipelines", "codestar:List*", "cognito-idp:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-sync:ListDatasets", "connect:List*", "config:List*", "config:Describe*", "datapipeline:ListPipelines", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:DescribeCarrierGateways", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:List*", "ecs:Describe*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:List*", "firehose:DescribeDeliveryStream", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "lookoutvision:ListModels", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListProjects", "logs:Describe*", "machinelearning:Describe*", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "opsworks:Describe*", "opsworks-cm:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:List*", "route53:Get*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "states:ListActivities", "states:ListStateMachines", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf:List*", "waf-regional:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v14": { "createdDate": "2022-05-04T18:10:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "config:Describe*", "config:List*", "connect:List*", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v15": { "createdDate": "2022-05-06T21:01:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "config:Describe*", "config:List*", "connect:List*", "comprehend:Describe*", "comprehend:List*", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v16": { "createdDate": "2023-01-05T20:51:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "config:Describe*", "config:List*", "connect:List*", "comprehend:Describe*", "comprehend:List*", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobilehub:ListAvailableFeatures", "mobilehub:ListAvailableRegions", "mobilehub:ListProjects", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v17": { "createdDate": "2023-03-06T15:59:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "batch:ListJobs", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudhsm:ListAvailableZones", "cloudhsm:ListHapgs", "cloudhsm:ListHsms", "cloudhsm:ListLunaClients", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "config:Describe*", "config:List*", "connect:List*", "comprehend:Describe*", "comprehend:List*", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kms:ListKeys", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "rds:Describe*", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:List*", "shield:List*", "sns:List*", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v18": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendationSummaries", "cost-optimization-hub:ListRecommendations", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAccelerators", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachineVersions", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v19": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendationSummaries", "cost-optimization-hub:ListRecommendations", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAccelerators", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachineVersions", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v20": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendationSummaries", "cost-optimization-hub:ListRecommendations", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAccelerators", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachineVersions", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v21": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendationSummaries", "cost-optimization-hub:ListRecommendations", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdFormat", "ec2:DescribeIdentityIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:DescribeAccelerators", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBots", "lex:GetIntentVersions", "lex:GetIntents", "lex:GetSlotTypeVersions", "lex:GetSlotTypes", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstanceSnapshots", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "m2:ListEnvironments", "m2:ListApplications", "m2:GetEnvironment", "m2:GetApplication", "m2:ListTagsForResource", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:ListQueues", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachineVersions", "states:ListStateMachines", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v22": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlans", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:ListEntitiesForLogGroup", "logs:ListLogGroupsForEntity", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachines", "states:ListStateMachineVersions", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v23": { "createdDate": "2016-11-10T17:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GeneralViewOnlyAccessStatement", "Effect": "Allow", "Action": [ "acm:ListCertificates", "aiops:GetInvestigation", "aiops:GetInvestigationGroup", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlans", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elastic-inference:DescribeAcceleratorOfferings", "elastic-inference:DescribeAccelerators", "elastic-inference:DescribeAcceleratorTypes", "elastic-inference:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:GetTransformer", "logs:ListEntitiesForLogGroup", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "route53:Get*", "route53:List*", "route53domains:List*", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListStateMachineAliases", "states:ListStateMachines", "states:ListStateMachineVersions", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "APIGatewayAccess", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } } }, "createdDate": "2016-11-10T17:20:15.000Z", "lastUpdatedDate": "2024-12-19T22:52:06.000Z" }, "SupportUser": { "arn": "arn:aws:iam::aws:policy/job-function/SupportUser", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2016-11-10T17:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ec2:GetFlowLogsCount", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "importexport:GetJobDetail", "inspector:Describe*", "inspector:List*", "inspector:GetAssessmentTelemetry", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workspaces:Describe*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-05-17T23:11:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:Describe*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ec2:GetFlowLogsCount", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "importexport:GetJobDetail", "inspector:Describe*", "inspector:List*", "inspector:GetAssessmentTelemetry", "inspector:LocalizeText", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workspaces:Describe*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2020-08-18T22:30:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:Describe*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workspaces:Describe*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-03-26T23:19:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "apigateway:GET", "appstream:Get*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:Describe*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workspaces:Describe*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2021-06-11T19:46:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities", "apigateway:GET", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:Describe*", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workspaces:Describe*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2022-02-02T15:11:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities", "apigateway:GET", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2022-07-25T22:45:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities", "apigateway:GET", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ec2:SearchLocalGatewayRoutes", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "mobilehub:GetProject", "mobilehub:List*", "mobilehub:ValidateProject", "mobilehub:VerifyServiceRole", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2016-11-10T17:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*", "acm:DescribeCertificate", "acm:GetCertificate", "acm:List*", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities", "apigateway:GET", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:EstimateTemplateCost", "cloudfront:Get*", "cloudfront:List*", "cloudsearch:Describe*", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codedeploy:Batch*", "codedeploy:Get*", "codedeploy:List*", "codepipeline:AcknowledgeJob", "codepipeline:AcknowledgeThirdPartyJob", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:PollForJobs", "codepipeline:PollForThirdPartyJobs", "codepipeline:GetPipelineState", "codepipeline:GetPipeline", "cognito-identity:List*", "cognito-identity:LookupDeveloperIdentity", "cognito-identity:Describe*", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:List*", "cognito-sync:Describe*", "cognito-sync:GetBulkPublishDetails", "cognito-sync:GetCognitoEvents", "cognito-sync:GetIdentityPoolConfiguration", "cognito-sync:List*", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetResourceConfigHistory", "config:ListDiscoveredResources", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:QueryObjects", "datapipeline:ReportTaskProgress", "datapipeline:ReportTaskRunnerHeartbeat", "devicefarm:List*", "devicefarm:Get*", "directconnect:Describe*", "discovery:Describe*", "discovery:ListConfigurations", "dms:Describe*", "dms:List*", "ds:DescribeDirectories", "ds:DescribeSnapshots", "ds:GetDirectoryLimits", "ds:GetSnapshotLimits", "ds:ListAuthorizedApplications", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "ec2:DescribeHosts", "ec2:describeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeInstanceAttribute", "ec2:DescribeNatGateways", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeTags", "ec2:SearchLocalGatewayRoutes", "ecr:GetRepositoryPolicy", "ecr:BatchCheckLayerAvailability", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "elastictranscoder:List*", "elastictranscoder:ReadJob", "elasticfilesystem:DescribeFileSystems", "es:Describe*", "es:List*", "es:ESHttpGet", "es:ESHttpHead", "events:DescribeRule", "events:List*", "events:TestEventPattern", "firehose:Describe*", "firehose:List*", "gamelift:List*", "gamelift:Describe*", "glacier:ListVaults", "glacier:DescribeVault", "glacier:DescribeJob", "glacier:Get*", "glacier:List*", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:Get*", "iam:List*", "importexport:GetStatus", "importexport:ListJobs", "inspector:Describe*", "inspector:List*", "iot:Describe*", "iot:Get*", "iot:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:DiscoverInputSchema", "kinesisanalytics:GetApplicationState", "kinesisanalytics:ListApplications", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "kms:Describe*", "kms:Get*", "kms:List*", "lambda:List*", "lambda:Get*", "logs:Describe*", "logs:TestMetricFilter", "machinelearning:Describe*", "machinelearning:Get*", "opsworks:Describe*", "rds:Describe*", "rds:ListTagsForResource", "redshift:Describe*", "route53:Get*", "route53:List*", "route53domains:CheckDomainAvailability", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:List*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "servicecatalog:SearchProducts", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:ListLaunchPaths", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListRecordHistory", "servicecatalog:DescribeRecord", "servicecatalog:ScanProvisionedProducts", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "sqs:ReceiveMessage", "ssm:List*", "ssm:Describe*", "storagegateway:Describe*", "storagegateway:List*", "swf:Count*", "swf:Describe*", "swf:Get*", "swf:List*", "waf:Get*", "waf:List*", "workdocs:Describe*", "workmail:Describe*", "workmail:Get*", "workspaces:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2016-11-10T17:21:53.000Z", "lastUpdatedDate": "2023-08-25T18:40:27.000Z" }, "SystemAdministrator": { "arn": "arn:aws:iam::aws:policy/job-function/SystemAdministrator", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2016-11-10T17:23:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "s3:*", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lamdba-sysadmin-*" ] } ] } }, "v4": { "createdDate": "2018-10-08T21:33:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "s3:*", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lamdba-sysadmin-*", "arn:aws:iam::*:role/lambda-sysadmin-*" ] } ] } }, "v2": { "createdDate": "2017-03-24T17:45:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "s3:*", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lamdba-sysadmin-*" ] } ] } }, "v5": { "createdDate": "2019-06-18T23:13:44.000Z", "document": { "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "s3:*", "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lambda-sysadmin-*" ] } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2017-12-15T23:59:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "s3:*", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lamdba-sysadmin-*", "arn:aws:iam::*:role/lambda-sysadmin-*" ] } ] } }, "v6": { "createdDate": "2020-08-24T20:05:29.000Z", "document": { "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetLaunchTemplateData", "ec2:GetPasswordData", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "s3:*", "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lambda-sysadmin-*" ] } ], "Version": "2012-10-17" } }, "v7": { "createdDate": "2016-11-10T17:23:56.000Z", "document": { "Statement": [ { "Action": [ "acm:Describe*", "acm:Get*", "acm:List*", "acm:Request*", "acm:Resend*", "autoscaling:*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudwatch:*", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateRepository", "codecommit:Get*", "codecommit:GitPull", "codecommit:GitPush", "codecommit:List*", "codecommit:Put*", "codecommit:Test*", "codecommit:Update*", "codedeploy:*", "codepipeline:*", "config:*", "ds:*", "ec2:Allocate*", "ec2:AssignPrivateIpAddresses*", "ec2:Associate*", "ec2:Allocate*", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:Bundle*", "ec2:Cancel*", "ec2:Copy*", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateImage", "ec2:CreateInstanceExportTask", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreatePlacementGroup", "ec2:CreateReservedInstancesListing", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateSpotDatafeedSubscription", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteFlowLogs", "ec2:DeleteKeyPair", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeletePlacementGroup", "ec2:DeleteSnapshot", "ec2:DeleteSpotDatafeedSubscription", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DeregisterImage", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:EnableVolumeIO", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetConsoleOutput", "ec2:GetHostReservationPurchasePreview", "ec2:GetLaunchTemplateData", "ec2:GetPasswordData", "ec2:GetSecurityGroupsForVpc", "ec2:Import*", "ec2:Modify*", "ec2:MonitorInstances", "ec2:MoveAddressToVpc", "ec2:Purchase*", "ec2:RegisterImage", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:RestoreAddressToClassic", "ec2:RunScheduledInstances", "ec2:UnassignPrivateIpAddresses", "ec2:UnmonitorInstances", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticloadbalancing:*", "events:*", "iam:GetAccount*", "iam:GetContextKeys*", "iam:GetCredentialReport", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:Simulate*", "iam:UpdateServerCertificate", "iam:UpdateSigningCertificate", "kinesis:ListStreams", "kinesis:PutRecord", "kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:Encrypt", "kms:ReEncrypt*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:List*", "lambda:PublishVersion", "lambda:Update*", "logs:*", "rds:Describe*", "rds:ListTagsForResource", "route53:*", "route53domains:*", "ses:*", "sns:*", "sqs:*", "trustedadvisor:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl*", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DetachVolume", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RebootInstances", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "s3:*", "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetAccessKeyLastUsed", "iam:GetGroup*", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy*", "iam:GetRole*", "iam:GetSAMLProvider", "iam:GetSSHPublicKey", "iam:GetServerCertificate", "iam:GetServiceLastAccessed*", "iam:GetUser*", "iam:ListAccessKeys", "iam:ListAttached*", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles*", "iam:ListMFADevices", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListSSHPublicKeys", "iam:ListSigningCertificates", "iam:ListUserPolicies", "iam:Upload*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/ec2-sysadmin-*", "arn:aws:iam::*:role/ecr-sysadmin-*", "arn:aws:iam::*:role/lambda-sysadmin-*" ] } ], "Version": "2012-10-17" } } }, "createdDate": "2016-11-10T17:23:56.000Z", "lastUpdatedDate": "2025-02-11T22:07:07.000Z" }, "DatabaseAdministrator": { "arn": "arn:aws:iam::aws:policy/job-function/DatabaseAdministrator", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2019-01-08T00:48:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:Describe*", "cloudwatch:DisableAlarmActions", "cloudwatch:EnableAlarmActions", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticache:*", "iam:ListRoles", "iam:GetRole", "kms:ListKeys", "lambda:CreateEventSourceMapping", "lambda:CreateFunction", "lambda:DeleteEventSourceMapping", "lambda:DeleteFunction", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:Create*", "logs:PutLogEvents", "logs:PutMetricFilter", "rds:*", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:DeleteTopic", "sns:Get*", "sns:List*", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject*", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutLifecycleConfiguration", "s3:PutReplicationConfiguration", "s3:PutObject*", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/rdbms-lambda-access", "arn:aws:iam::*:role/lambda_exec_role", "arn:aws:iam::*:role/lambda-dynamodb-*", "arn:aws:iam::*:role/lambda-vpc-execution-role", "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole" ] } ] } }, "v1": { "createdDate": "2016-11-10T17:25:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:Describe*", "cloudwatch:DisableAlarmActions", "cloudwatch:EnableAlarmActions", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:PutMetricAlarm", "datapipeline:ActivatePipeline", "datapipeline:CreatePipeline", "datapipeline:DeletePipeline", "datapipeline:DescribeObjects", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datapipeline:PutPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticache:*", "iam:ListRoles", "iam:GetRole", "kms:ListKeys", "lambda:CreateEventSourceMapping", "lambda:CreateFunction", "lambda:DeleteEventSourceMapping", "lambda:DeleteFunction", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:Create*", "logs:PutLogEvents", "logs:PutMetricFilter", "rds:*", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:DeleteTopic", "sns:Get*", "sns:List*", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject*", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutLifecycleConfiguration", "s3:PutReplicationConfiguration", "s3:PutObject*", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/rds-monitoring-role", "arn:aws:iam::*:role/rdbms-lambda-access", "arn:aws:iam::*:role/lambda_exec_role", "arn:aws:iam::*:role/lambda-dynamodb-*", "arn:aws:iam::*:role/lambda-vpc-execution-role", "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole" ] } ] } } }, "createdDate": "2016-11-10T17:25:43.000Z", "lastUpdatedDate": "2019-01-08T00:48:02.000Z" }, "DataScientist": { "arn": "arn:aws:iam::aws:policy/job-function/DataScientist", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2018-07-02T17:23:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:*", "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "datapipeline:Describe*", "datapipeline:ListPipelines", "datapipeline:GetPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:CancelSpotInstanceRequests", "ec2:CancelSpotFleetRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotInstances", "ec2:RequestSpotFleet", "elasticfilesystem:*", "elasticmapreduce:*", "es:*", "firehose:*", "iam:GetInstanceProfile", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "kinesis:*", "kms:List*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:PublishVersion", "lambda:Update*", "lambda:List*", "machinelearning:*", "sdb:*", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:Get*", "sns:List*", "sagemaker:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Abort*", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketLogging", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutObject", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "arn:aws:iam::*:role/EMR_DefaultRole", "arn:aws:iam::*:role/kinesis-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2016-11-10T17:28:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:*", "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "datapipeline:Describe*", "datapipeline:ListPipelines", "datapipeline:GetPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:CancelSpotInstanceRequests", "ec2:CancelSpotFleetRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotInstances", "ec2:RequestSpotFleet", "elasticfilesystem:*", "elasticmapreduce:*", "es:*", "firehose:*", "iam:GetInstanceProfile", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "kinesis:*", "kms:List*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:PublishVersion", "lambda:Update*", "lambda:List*", "machinelearning:*", "sdb:*", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Abort*", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketLogging", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutObject", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "arn:aws:iam::*:role/EMR_DefaultRole", "arn:aws:iam::*:role/kinesis-*" ] } ] } }, "v3": { "createdDate": "2019-01-18T19:26:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:*", "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "datapipeline:Describe*", "datapipeline:ListPipelines", "datapipeline:GetPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:CancelSpotInstanceRequests", "ec2:CancelSpotFleetRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotInstances", "ec2:RequestSpotFleet", "elasticfilesystem:*", "elasticmapreduce:*", "es:*", "firehose:*", "iam:GetInstanceProfile", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "kinesis:*", "kms:List*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:PublishVersion", "lambda:Update*", "lambda:List*", "machinelearning:*", "sdb:*", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:Get*", "sns:List*", "sagemaker:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Abort*", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketLogging", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutObject", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "arn:aws:iam::*:role/EMR_DefaultRole", "arn:aws:iam::*:role/kinesis-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2019-08-21T23:13:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:*", "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "datapipeline:Describe*", "datapipeline:ListPipelines", "datapipeline:GetPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:CancelSpotInstanceRequests", "ec2:CancelSpotFleetRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotInstances", "ec2:RequestSpotFleet", "elasticfilesystem:*", "elasticmapreduce:*", "es:*", "firehose:*", "fsx:DescribeFileSystems", "iam:GetInstanceProfile", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "kinesis:*", "kms:List*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:PublishVersion", "lambda:Update*", "lambda:List*", "machinelearning:*", "sdb:*", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:Get*", "sns:List*", "sagemaker:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Abort*", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketLogging", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutObject", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "arn:aws:iam::*:role/EMR_DefaultRole", "arn:aws:iam::*:role/kinesis-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2019-12-03T16:48:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:*", "cloudwatch:*", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "datapipeline:Describe*", "datapipeline:ListPipelines", "datapipeline:GetPipelineDefinition", "datapipeline:QueryObjects", "dynamodb:*", "ec2:CancelSpotInstanceRequests", "ec2:CancelSpotFleetRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotInstances", "ec2:RequestSpotFleet", "elasticfilesystem:*", "elasticmapreduce:*", "es:*", "firehose:*", "fsx:DescribeFileSystems", "iam:GetInstanceProfile", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListRoles", "kinesis:*", "kms:List*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:InvokeFunction", "lambda:PublishVersion", "lambda:Update*", "lambda:List*", "machinelearning:*", "sdb:*", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "logs:DescribeLogStreams", "logs:GetLogEvents", "redshift:*", "s3:CreateBucket", "sns:CreateTopic", "sns:Get*", "sns:List*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Abort*", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:PutAccelerateConfiguration", "s3:PutBucketCors", "s3:PutBucketLogging", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutObject", "s3:Replicate*", "s3:RestoreObject" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultRole", "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "arn:aws:iam::*:role/EMR_DefaultRole", "arn:aws:iam::*:role/kinesis-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:*FlowDefinition", "sagemaker:*FlowDefinitions" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } } ] } } }, "createdDate": "2016-11-10T17:28:48.000Z", "lastUpdatedDate": "2019-12-03T16:48:34.000Z" }, "NetworkAdministrator": { "arn": "arn:aws:iam::aws:policy/job-function/NetworkAdministrator", "latestVersionId": "v13", "versionsCount": 13, "versions": { "v1": { "createdDate": "2016-11-10T17:31:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AllocateAddress", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:CreatePlacementGroup", "ec2:DeletePlacementGroup", "ec2:DescribePlacementGroups", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateway", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:MoveAddressToVpc", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignPrivateIpAddresses", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsiteConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" } ] } }, "v2": { "createdDate": "2017-03-20T18:44:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AllocateAddress", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDhcpOptions", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:CreatePlacementGroup", "ec2:DeletePlacementGroup", "ec2:DescribePlacementGroups", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeDhcpOptions", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:EnableVgwRoutePropagation", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:MoveAddressToVpc", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignPrivateIpAddresses", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsiteConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" } ] } }, "v4": { "createdDate": "2019-07-11T18:08:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsiteConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-01-16T00:49:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-12-13T19:43:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsiteConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" } ] } }, "v6": { "createdDate": "2020-03-31T16:34:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2020-08-08T00:10:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2021-07-20T21:05:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudfront:ListDistributions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "directconnect:*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "route53:*", "route53domains:*", "sns:CreateTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateLocalGatewayRoute", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:DeleteLocalGatewayRoute", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:SearchLocalGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketWebsite", "s3:ListBucket" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGateway", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2020-09-24T23:55:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:DeleteCarrierGateway", "ec2:DescribeCarrierGateways", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "directconnect:*", "route53:*", "route53domains:*", "cloudfront:ListDistributions", "elasticloadbalancing:*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:RequestEnvironmentInfo", "sns:ListTopics", "sns:ListSubscriptionsByTopic", "sns:CreateTopic", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketWebsite" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2021-09-16T20:22:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudfront:ListDistributions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "directconnect:*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribePublicIpv4Pools", "ec2:DescribeIpv6Pools", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "route53:*", "route53domains:*", "sns:CreateTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateLocalGatewayRoute", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:DeleteLocalGatewayRoute", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:SearchLocalGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketWebsite", "s3:ListBucket" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGateway", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2021-09-03T20:25:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudfront:ListDistributions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "directconnect:*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "route53:*", "route53domains:*", "sns:CreateTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateLocalGatewayRoute", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:DeleteLocalGatewayRoute", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:SearchLocalGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketWebsite", "s3:ListBucket" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGateway", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2016-11-10T17:31:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDefaultNetworkAdminActions", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudfront:ListDistributions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "directconnect:*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribePublicIpv4Pools", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetVpnConnectionDeviceSampleConfiguration", "ec2:GetVpnConnectionDeviceTypes", "ec2:GetVpnTunnelReplacementStatus", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:ModifyVpnConnection", "ec2:ModifyVpnConnectionOptions", "ec2:ModifyVpnTunnelCertificate", "ec2:ModifyVpnTunnelOptions", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ReplaceVpnTunnel", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "route53:*", "route53domains:*", "sns:CreateTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": "*" }, { "Sid": "AllowVPCPermissions", "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Sid": "AllowLocalGatewayPermissions", "Effect": "Allow", "Action": [ "ec2:CreateLocalGatewayRoute", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:DeleteLocalGatewayRoute", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:SearchLocalGatewayRoutes" ], "Resource": "*" }, { "Sid": "DiscoverBuckets", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketWebsite", "s3:ListBucket" ], "Resource": [ "*" ] }, { "Sid": "DiscoverFlowLogRoles", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Sid": "NetworkmanagerPermissions", "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Sid": "TransitGatewayPermissions", "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGateway", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Sid": "AllowTransitGatewaySLRCreation", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2016-11-10T17:31:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDefaultNetworkAdminActions", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudfront:ListDistributions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "directconnect:*", "ec2:AcceptVpcEndpointConnections", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateDhcpOptions", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVpnGateway", "ec2:CreateCarrierGateway", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateFlowLogs", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointConnectionNotification", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpnConnection", "ec2:CreateVpnConnectionRoute", "ec2:CreateVpnGateway", "ec2:DeleteCarrierGateway", "ec2:DeleteEgressOnlyInternetGateway", "ec2:DeleteFlowLogs", "ec2:DeleteNatGateway", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpointConnectionNotifications", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcEndpoints", "ec2:DeleteVpnConnection", "ec2:DeleteVpnConnectionRoute", "ec2:DeleteVpnGateway", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpv6Pools", "ec2:DescribeKeyPairs", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribePublicIpv4Pools", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DetachInternetGateway", "ec2:DetachNetworkInterface", "ec2:DetachVpnGateway", "ec2:DisableVgwRoutePropagation", "ec2:DisableVpcClassicLinkDnsSupport", "ec2:DisassociateAddress", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:DisassociateVpcCidrBlock", "ec2:EnableVgwRoutePropagation", "ec2:EnableVpcClassicLinkDnsSupport", "ec2:GetVpnConnectionDeviceSampleConfiguration", "ec2:GetVpnConnectionDeviceTypes", "ec2:GetVpnTunnelReplacementStatus", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySecurityGroupRules", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointConnectionNotification", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions", "ec2:ModifyVpcPeeringConnectionOptions", "ec2:ModifyVpcTenancy", "ec2:ModifyVpnConnection", "ec2:ModifyVpnConnectionOptions", "ec2:ModifyVpnTunnelCertificate", "ec2:ModifyVpnTunnelOptions", "ec2:MoveAddressToVpc", "ec2:RejectVpcEndpointConnections", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:ReplaceNetworkAclEntry", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:ReplaceVpnTunnel", "ec2:ResetNetworkInterfaceAttribute", "ec2:RestoreAddressToClassic", "ec2:UnassignIpv6Addresses", "ec2:UnassignPrivateIpAddresses", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "route53:*", "route53domains:*", "sns:CreateTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": "*" }, { "Sid": "AllowVPCPermissions", "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:AssociateSecurityGroupVpc", "ec2:AttachClassicLinkVpc", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateVpcPeeringConnection", "ec2:DeleteCustomerGateway", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpcPeeringConnection", "ec2:DescribeSecurityGroupVpcAssociations", "ec2:DetachClassicLinkVpc", "ec2:DisableVpcClassicLink", "ec2:DisassociateSecurityGroupVpc", "ec2:EnableVpcClassicLink", "ec2:GetConsoleScreenshot", "ec2:GetSecurityGroupsForVpc", "ec2:RejectVpcPeeringConnection", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "*" ] }, { "Sid": "AllowLocalGatewayPermissions", "Effect": "Allow", "Action": [ "ec2:CreateLocalGatewayRoute", "ec2:CreateLocalGatewayRouteTableVpcAssociation", "ec2:DeleteLocalGatewayRoute", "ec2:DeleteLocalGatewayRouteTableVpcAssociation", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeLocalGateways", "ec2:SearchLocalGatewayRoutes" ], "Resource": "*" }, { "Sid": "DiscoverBuckets", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketWebsite", "s3:ListBucket" ], "Resource": [ "*" ] }, { "Sid": "DiscoverFlowLogRoles", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/flow-logs-*" }, { "Sid": "NetworkmanagerPermissions", "Effect": "Allow", "Action": [ "networkmanager:*" ], "Resource": "*" }, { "Sid": "TransitGatewayPermissions", "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AssociateTransitGatewayRouteTable", "ec2:CreateTransitGateway", "ec2:CreateTransitGatewayRoute", "ec2:CreateTransitGatewayRouteTable", "ec2:CreateTransitGatewayVpcAttachment", "ec2:DeleteTransitGateway", "ec2:DeleteTransitGatewayRoute", "ec2:DeleteTransitGatewayRouteTable", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DisableTransitGatewayRouteTablePropagation", "ec2:DisassociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:ExportTransitGatewayRoutes", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:ModifyTransitGateway", "ec2:ModifyTransitGatewayVpcAttachment", "ec2:RejectTransitGatewayVpcAttachment", "ec2:ReplaceTransitGatewayRoute", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" }, { "Sid": "AllowTransitGatewaySLRCreation", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "transitgateway.amazonaws.com" ] } } } ] } } }, "createdDate": "2016-11-10T17:31:35.000Z", "lastUpdatedDate": "2024-12-19T22:52:06.000Z" }, "Billing": { "arn": "arn:aws:iam::aws:policy/job-function/Billing", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "aws-portal:*Usage", "aws-portal:*PaymentMethods", "budgets:ViewBudget", "budgets:ModifyBudget" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-02-06T23:46:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "awsbillingconsole:*Billing", "aws-portal:*Usage", "awsbillingconsole:*Usage", "aws-portal:*PaymentMethods", "awsbillingconsole:*PaymentMethods", "budgets:ViewBudget", "budgets:ModifyBudget", "cur:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-24T18:12:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "awsbillingconsole:*Billing", "aws-portal:*Usage", "awsbillingconsole:*Usage", "aws-portal:*PaymentMethods", "awsbillingconsole:*PaymentMethods", "budgets:ViewBudget", "budgets:ModifyBudget", "cur:*", "purchase-orders:*PurchaseOrders" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-08-27T20:09:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "aws-portal:*Usage", "aws-portal:*PaymentMethods", "budgets:ViewBudget", "budgets:ModifyBudget", "cur:*", "purchase-orders:*PurchaseOrders" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-10-05T20:37:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "aws-portal:*Usage", "aws-portal:*PaymentMethods", "budgets:ViewBudget", "budgets:ModifyBudget", "ce:UpdatePreferences", "ce:CreateReport", "ce:UpdateReport", "ce:DeleteReport", "ce:CreateNotificationSubscription", "ce:UpdateNotificationSubscription", "ce:DeleteNotificationSubscription", "cur:DescribeReportDefinitions", "cur:PutReportDefinition", "cur:ModifyReportDefinition", "cur:DeleteReportDefinition", "purchase-orders:*PurchaseOrders" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-03-08T18:01:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:ModifyBudget", "budgets:ViewBudget", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:MakePayment", "payments:UpdatePaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2023-06-28T19:47:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:ModifyBudget", "budgets:ViewBudget", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:MakePayment", "payments:UpdatePaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2023-07-26T19:58:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:ModifyBudget", "budgets:ViewBudget", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:ListCostAllocationTags", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:MakePayment", "payments:UpdatePaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:MakePayment", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:MakePayment", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "payments:MakePayment", "payments:TagResource", "payments:UpdatePaymentPreferences", "payments:UpdatePaymentInstrument", "payments:UntagResource", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreateFinancingApplication", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "payments:MakePayment", "payments:TagResource", "payments:UntagResource", "payments:UpdateFinancingApplication", "payments:UpdatePaymentInstrument", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:BatchGetInvoiceProfile", "invoicing:CreateInvoiceUnit", "invoicing:DeleteInvoiceUnit", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:GetInvoiceUnit", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", "invoicing:ListTagsForResource", "invoicing:PutInvoiceEmailDeliveryPreferences", "invoicing:TagResource", "invoicing:UntagResource", "invoicing:UpdateInvoiceUnit", "payments:CreateFinancingApplication", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "payments:MakePayment", "payments:TagResource", "payments:UntagResource", "payments:UpdateFinancingApplication", "payments:UpdatePaymentInstrument", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:CreateBillingView", "billing:DeleteBillingView", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetBillingView", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:GetResourcePolicy", "billing:ListSourceViewsForBillingView", "billing:ListTagsForResource", "billing:TagResource", "billing:UntagResource", "billing:UpdateBillingPreferences", "billing:UpdateBillingView", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:BatchGetInvoiceProfile", "invoicing:CreateInvoiceUnit", "invoicing:DeleteInvoiceUnit", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:GetInvoiceUnit", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", "invoicing:ListTagsForResource", "invoicing:PutInvoiceEmailDeliveryPreferences", "invoicing:TagResource", "invoicing:UntagResource", "invoicing:UpdateInvoiceUnit", "payments:CreateFinancingApplication", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "payments:MakePayment", "payments:TagResource", "payments:UntagResource", "payments:UpdateFinancingApplication", "payments:UpdatePaymentInstrument", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2016-11-10T17:33:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:*Billing", "aws-portal:*PaymentMethods", "aws-portal:*Usage", "billing:CreateBillingView", "billing:DeleteBillingView", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetBillingView", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "billing:PutContractInformation", "billing:RedeemCredits", "billing:GetResourcePolicy", "billing:ListSourceViewsForBillingView", "billing:ListTagsForResource", "billing:TagResource", "billing:UntagResource", "billing:UpdateBillingPreferences", "billing:UpdateBillingView", "billing:UpdateIAMAccessPreference", "budgets:CreateBudgetAction", "budgets:DeleteBudgetAction", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "budgets:ExecuteBudgetAction", "budgets:ModifyBudget", "budgets:UpdateBudgetAction", "budgets:ViewBudget", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:DeleteCostCategoryDefinition", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostAllocationTags", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:TagResource", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "ce:UpdateReport", "ce:UpdateCostCategoryDefinition", "ce:UntagResource", "ce:StartCostAllocationTagBackfill", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ModifyReportDefinition", "cur:PutClassicReportPreferences", "cur:PutReportDefinition", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "freetier:PutFreeTierAlertPreference", "invoicing:BatchGetInvoiceProfile", "invoicing:CreateInvoiceUnit", "invoicing:DeleteInvoiceUnit", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:GetInvoiceUnit", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", "invoicing:ListTagsForResource", "invoicing:PutInvoiceEmailDeliveryPreferences", "invoicing:TagResource", "invoicing:UntagResource", "invoicing:UpdateInvoiceUnit", "mapcredits:ListQuarterSpend", "mapcredits:ListAssociatedPrograms", "mapcredits:ListQuarterCredits", "payments:CreateFinancingApplication", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "payments:MakePayment", "payments:TagResource", "payments:UntagResource", "payments:UpdateFinancingApplication", "payments:UpdatePaymentInstrument", "payments:UpdatePaymentPreferences", "pricing:DescribeServices", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "support:CreateCase", "support:AddAttachmentsToSet", "sustainability:GetCarbonFootprintSummary", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:GetExemptions", "tax:GetTaxInheritance", "tax:GetTaxInterview", "tax:GetTaxRegistration", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "tax:PutTaxInheritance", "tax:PutTaxInterview", "tax:PutTaxRegistration", "tax:UpdateExemptions" ], "Resource": "*" } ] } } }, "createdDate": "2016-11-10T17:33:18.000Z", "lastUpdatedDate": "2025-03-12T18:07:07.000Z" }, "IAMUserChangePassword": { "arn": "arn:aws:iam::aws:policy/IAMUserChangePassword", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-11-15T00:25:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ChangePassword" ], "Resource": [ "arn:aws:iam::*:user/${aws:userid}" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2016-11-15T23:18:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ChangePassword" ], "Resource": [ "arn:aws:iam::*:user/${aws:username}" ] }, { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy" ], "Resource": "*" } ] } } }, "createdDate": "2016-11-15T00:25:16.000Z", "lastUpdatedDate": "2016-11-15T23:18:55.000Z" }, "AmazonElasticMapReduceforAutoScalingRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-11-18T01:09:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarms", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ModifyInstanceGroups" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2016-11-18T01:09:10.000Z", "lastUpdatedDate": "2016-11-18T01:09:10.000Z" }, "AmazonAppStreamServiceAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonAppStreamServiceAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2016-11-19T04:17:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-05-03T17:00:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::appstream2-36fb080bb8-*" } ] } }, "v3": { "createdDate": "2017-05-23T23:00:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::appstream2-36fb080bb8-*" } ] } }, "v4": { "createdDate": "2018-08-13T18:19:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::appstream2-36fb080bb8-*", "arn:aws:s3:::appstream-app-settings-*" ] } ] } }, "v5": { "createdDate": "2019-01-17T20:22:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::appstream2-36fb080bb8-*", "arn:aws:s3:::appstream-app-settings-*", "arn:aws:s3:::appstream-logs-*" ] } ] } }, "v6": { "createdDate": "2019-08-07T18:29:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::appstream2-36fb080bb8-*", "arn:aws:s3:::appstream-app-settings-*", "arn:aws:s3:::appstream-logs-*" ] } ] } }, "v7": { "createdDate": "2020-03-23T18:20:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::appstream2-36fb080bb8-*", "arn:aws:s3:::appstream-app-settings-*", "arn:aws:s3:::appstream-logs-*" ] } ] } }, "v8": { "createdDate": "2020-06-26T16:33:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::appstream2-36fb080bb8-*", "arn:aws:s3:::appstream-app-settings-*", "arn:aws:s3:::appstream-logs-*" ] } ] } } }, "createdDate": "2016-11-19T04:17:37.000Z", "lastUpdatedDate": "2020-06-26T16:33:54.000Z" }, "AWSOpsWorksCMInstanceProfileRole": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorksCMInstanceProfileRole", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2016-11-24T09:48:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": "arn:aws:s3:::aws-opsworks-cm-*", "Effect": "Allow" } ] } }, "v2": { "createdDate": "2017-11-03T12:01:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:DescribeStackResource", "cloudformation:SignalResource" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": "arn:aws:s3:::aws-opsworks-cm-*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2019-10-22T07:40:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:DescribeStackResource", "cloudformation:SignalResource" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": "arn:aws:s3:::aws-opsworks-cm-*", "Effect": "Allow" }, { "Action": "acm:GetCertificate", "Resource": "*", "Effect": "Allow" } ] } }, "v4": { "createdDate": "2021-01-12T09:37:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:DescribeStackResource", "cloudformation:SignalResource" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": "arn:aws:s3:::aws-opsworks-cm-*", "Effect": "Allow" }, { "Action": "acm:GetCertificate", "Resource": "*", "Effect": "Allow" }, { "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:*:*:aws-opsworks-cm-secrets-*", "Effect": "Allow" } ] } }, "v5": { "createdDate": "2021-04-23T17:34:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:DescribeStackResource", "cloudformation:SignalResource" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": "arn:aws:s3:::aws-opsworks-cm-*", "Effect": "Allow" }, { "Action": "acm:GetCertificate", "Resource": "*", "Effect": "Allow" }, { "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:*:*:opsworks-cm!aws-opsworks-cm-secrets-*", "Effect": "Allow" } ] } } }, "createdDate": "2016-11-24T09:48:22.000Z", "lastUpdatedDate": "2021-04-23T17:34:03.000Z" }, "AWSOpsWorksCMServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSOpsWorksCMServiceRole", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2016-11-24T09:49:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v2": { "createdDate": "2016-11-25T08:27:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v3": { "createdDate": "2016-11-25T19:12:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v4": { "createdDate": "2017-02-17T09:41:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v5": { "createdDate": "2017-03-07T14:12:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects", "s3:PutBucketPolicy" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v6": { "createdDate": "2017-04-03T12:00:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects", "s3:PutBucketPolicy" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v7": { "createdDate": "2018-09-25T08:05:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects", "s3:PutBucketPolicy", "s3:PutObject" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v8": { "createdDate": "2019-02-21T15:15:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:ListObjects", "s3:PutBucketPolicy", "s3:PutObject" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v9": { "createdDate": "2019-06-07T19:39:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] } ] } }, "v10": { "createdDate": "2019-10-22T07:40:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] }, { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DeleteCertificate", "acm:ImportCertificate" ] } ] } }, "v11": { "createdDate": "2019-11-07T13:03:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] }, { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DeleteCertificate", "acm:ImportCertificate" ] } ] } }, "v12": { "createdDate": "2019-12-16T13:45:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject", "s3:GetBucketTagging", "s3:PutBucketTagging" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "tag:UntagResources", "tag:TagResources" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] }, { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DeleteCertificate", "acm:ImportCertificate" ] }, { "Effect": "Allow", "Action": "ec2:DeleteTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:elastic-ip/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } }, "v13": { "createdDate": "2021-01-06T15:08:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject", "s3:GetBucketTagging", "s3:PutBucketTagging" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "tag:UntagResources", "tag:TagResources" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] }, { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DeleteCertificate", "acm:ImportCertificate" ] }, { "Effect": "Allow", "Resource": "arn:aws:secretsmanager:*:*:aws-opsworks-cm-secrets-*", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource" ] }, { "Effect": "Allow", "Action": "ec2:DeleteTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:elastic-ip/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } }, "v14": { "createdDate": "2021-04-23T17:32:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket", "s3:GetObject", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutObject", "s3:GetBucketTagging", "s3:PutBucketTagging" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "tag:UntagResources", "tag:TagResources" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:ssm:*::document/*", "arn:aws:s3:::aws-opsworks-cm-*" ], "Action": [ "ssm:SendCommand" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RunInstances", "ec2:StopInstances" ] }, { "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-opsworks-cm-*" } }, "Action": [ "ec2:TerminateInstances", "ec2:RebootInstances" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:opsworks-cm:*:*:server/*" ], "Action": [ "opsworks-cm:DeleteServer", "opsworks-cm:StartMaintenance" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*" ], "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:UpdateStack" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-opsworks-cm-*", "arn:aws:iam::*:role/service-role/aws-opsworks-cm-*" ], "Action": [ "iam:PassRole" ] }, { "Effect": "Allow", "Resource": "*", "Action": [ "acm:DeleteCertificate", "acm:ImportCertificate" ] }, { "Effect": "Allow", "Resource": "arn:aws:secretsmanager:*:*:opsworks-cm!aws-opsworks-cm-secrets-*", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource" ] }, { "Effect": "Allow", "Action": "ec2:DeleteTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:elastic-ip/*", "arn:aws:ec2:*:*:security-group/*" ] } ] } } }, "createdDate": "2016-11-24T09:49:46.000Z", "lastUpdatedDate": "2021-04-23T17:32:13.000Z" }, "AmazonRekognitionFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRekognitionFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-11-30T14:40:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:*" ], "Resource": "*" } ] } } }, "createdDate": "2016-11-30T14:40:44.000Z", "lastUpdatedDate": "2016-11-30T14:40:44.000Z" }, "AmazonRekognitionReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRekognitionReadOnlyAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2016-11-30T14:58:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-12-06T23:28:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-02-20T21:26:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-01-08T20:02:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-07-06T20:21:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-10-15T22:07:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DetectProtectiveEquipment" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-11-03T02:53:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DetectProtectiveEquipment", "rekognition:ListTagsForResource", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2022-08-16T20:25:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DetectProtectiveEquipment", "rekognition:ListTagsForResource", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset", "rekognition:ListProjectPolicies" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2023-07-24T19:04:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DetectProtectiveEquipment", "rekognition:ListTagsForResource", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset", "rekognition:ListProjectPolicies", "rekognition:ListUsers", "rekognition:SearchUsers", "rekognition:SearchUsersByImage" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2016-11-30T14:58:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRekognitionReadOnlyAccess", "Effect": "Allow", "Action": [ "rekognition:CompareFaces", "rekognition:DetectFaces", "rekognition:DetectLabels", "rekognition:ListCollections", "rekognition:ListFaces", "rekognition:SearchFaces", "rekognition:SearchFacesByImage", "rekognition:DetectText", "rekognition:GetCelebrityInfo", "rekognition:RecognizeCelebrities", "rekognition:DetectModerationLabels", "rekognition:GetLabelDetection", "rekognition:GetFaceDetection", "rekognition:GetContentModeration", "rekognition:GetPersonTracking", "rekognition:GetCelebrityRecognition", "rekognition:GetFaceSearch", "rekognition:GetTextDetection", "rekognition:GetSegmentDetection", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DetectProtectiveEquipment", "rekognition:ListTagsForResource", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset", "rekognition:ListProjectPolicies", "rekognition:ListUsers", "rekognition:SearchUsers", "rekognition:SearchUsersByImage", "rekognition:GetMediaAnalysisJob", "rekognition:ListMediaAnalysisJobs" ], "Resource": "*" } ] } } }, "createdDate": "2016-11-30T14:58:06.000Z", "lastUpdatedDate": "2023-11-08T18:30:22.000Z" }, "AmazonAthenaFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "latestVersionId": "v13", "versionsCount": 13, "versions": { "v1": { "createdDate": "2016-11-30T16:46:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v2": { "createdDate": "2017-08-11T23:42:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v3": { "createdDate": "2017-09-13T00:13:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] } ] } }, "v5": { "createdDate": "2019-02-19T00:13:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2018-05-21T18:47:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] } ] } }, "v6": { "createdDate": "2019-08-08T17:52:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2021-07-07T20:15:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2022-11-14T21:05:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2023-01-24T16:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2016-11-30T16:46:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseAthenaPermissions", "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Sid": "BaseGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns" ], "Resource": [ "*" ] }, { "Sid": "BaseQueryResultsPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Sid": "BaseAthenaExamplesPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Sid": "BaseS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "BaseSNSPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Sid": "BaseCloudWatchPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "BaseLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] }, { "Sid": "BasePricingPermissions", "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2016-11-30T16:46:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseAthenaPermissions", "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Sid": "BaseGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns" ], "Resource": [ "*" ] }, { "Sid": "BaseQueryResultsPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Sid": "BaseAthenaExamplesPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Sid": "BaseS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "BaseSNSPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Sid": "BaseCloudWatchPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "BaseLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] }, { "Sid": "BaseDataZonePermissions", "Effect": "Allow", "Action": [ "datazone:ListDomains", "datazone:ListProjects", "datazone:ListAccountEnvironments" ], "Resource": [ "*" ] }, { "Sid": "BasePricingPermissions", "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] } ] } }, "v12": { "createdDate": "2016-11-30T16:46:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseAthenaPermissions", "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Sid": "BaseGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCatalogImportStatus" ], "Resource": [ "*" ] }, { "Sid": "BaseQueryResultsPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Sid": "BaseAthenaExamplesPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Sid": "BaseS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "BaseSNSPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Sid": "BaseCloudWatchPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "BaseLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] }, { "Sid": "BaseDataZonePermissions", "Effect": "Allow", "Action": [ "datazone:ListDomains", "datazone:ListProjects", "datazone:ListAccountEnvironments" ], "Resource": [ "*" ] }, { "Sid": "BasePricingPermissions", "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] } ] } }, "v13": { "createdDate": "2016-11-30T16:46:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseAthenaPermissions", "Effect": "Allow", "Action": [ "athena:*" ], "Resource": [ "*" ] }, { "Sid": "BaseGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCatalogImportStatus" ], "Resource": [ "*" ] }, { "Sid": "BaseQueryResultsPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Sid": "BaseAthenaExamplesPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::athena-examples*" ] }, { "Sid": "BaseS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "BaseSNSPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": [ "*" ] }, { "Sid": "BaseCloudWatchPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "BaseLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] }, { "Sid": "BaseDataZonePermissions", "Effect": "Allow", "Action": [ "datazone:ListDomains", "datazone:ListProjects", "datazone:ListAccountEnvironments" ], "Resource": [ "*" ] }, { "Sid": "BasePricingPermissions", "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-11-30T16:46:01.000Z", "lastUpdatedDate": "2025-01-03T00:37:06.000Z" }, "AmazonPollyFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPollyFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-11-30T18:59:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-11-30T18:59:06.000Z", "lastUpdatedDate": "2016-11-30T18:59:06.000Z" }, "AmazonPollyReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPollyReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-11-30T18:59:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:DescribeVoices", "polly:GetLexicon", "polly:ListLexicons", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-07-17T16:41:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:DescribeVoices", "polly:GetLexicon", "polly:GetSpeechSynthesisTask", "polly:ListLexicons", "polly:ListSpeechSynthesisTasks", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-11-30T18:59:24.000Z", "lastUpdatedDate": "2018-07-17T16:41:07.000Z" }, "AmazonSSMMaintenanceWindowRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSSMMaintenanceWindowRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-12-01T15:57:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1477803259000", "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:SendCommand" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-08-09T20:49:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1477803259000", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:ListCommands", "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "*" ] }, { "Sid": "Stmt1477803259001", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Sid": "Stmt1477803259002", "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] } ] } }, "v3": { "createdDate": "2019-07-27T00:16:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:ListCommands", "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-12-01T15:57:54.000Z", "lastUpdatedDate": "2019-07-27T00:16:05.000Z" }, "AWSXrayWriteOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-12-01T18:19:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-08-28T23:03:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-12-01T18:19:53.000Z", "lastUpdatedDate": "2018-08-28T23:03:04.000Z" }, "AWSXrayReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2016-12-01T18:27:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:BatchGetTraces", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-08-28T22:59:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-11-20T23:06:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2019-04-30T18:11:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup", "xray:GetTimeSeriesServiceStatistics" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2020-09-03T22:19:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup", "xray:ListTagsForResource", "xray:GetTimeSeriesServiceStatistics", "xray:GetInsightSummaries", "xray:GetInsight", "xray:GetInsightEvents", "xray:GetInsightImpactGraph" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2022-11-11T19:46:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:BatchGetTraceSummaryById", "xray:GetDistinctTraceGraphs", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup", "xray:ListTagsForResource", "xray:GetTimeSeriesServiceStatistics", "xray:GetInsightSummaries", "xray:GetInsight", "xray:GetInsightEvents", "xray:GetInsightImpactGraph" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2022-11-15T23:13:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:BatchGetTraceSummaryById", "xray:GetDistinctTraceGraphs", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup", "xray:ListTagsForResource", "xray:ListResourcePolicies", "xray:GetTimeSeriesServiceStatistics", "xray:GetInsightSummaries", "xray:GetInsight", "xray:GetInsightEvents", "xray:GetInsightImpactGraph" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2016-12-01T18:27:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSXrayReadOnlyAccess", "Effect": "Allow", "Action": [ "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries", "xray:BatchGetTraces", "xray:BatchGetTraceSummaryById", "xray:GetDistinctTraceGraphs", "xray:GetServiceGraph", "xray:GetTraceGraph", "xray:GetTraceSummaries", "xray:GetGroups", "xray:GetGroup", "xray:ListTagsForResource", "xray:ListResourcePolicies", "xray:GetTimeSeriesServiceStatistics", "xray:GetInsightSummaries", "xray:GetInsight", "xray:GetInsightEvents", "xray:GetInsightImpactGraph" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-12-01T18:27:02.000Z", "lastUpdatedDate": "2024-02-14T00:35:02.000Z" }, "AWSXrayFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSXrayFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-12-01T18:30:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2016-12-01T18:30:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSXrayFullAccess", "Effect": "Allow", "Action": [ "xray:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-12-01T18:30:55.000Z", "lastUpdatedDate": "2024-04-11T17:07:36.000Z" }, "AWSCodeBuildDeveloperAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess", "latestVersionId": "v16", "versionsCount": 16, "versions": { "v1": { "createdDate": "2016-12-01T19:02:32.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2017-10-25T19:54:49.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2018-10-03T18:56:53.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ], "Version": "2012-10-17" } }, "v5": { "createdDate": "2019-10-08T20:23:39.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ], "Version": "2012-10-17" } }, "v6": { "createdDate": "2019-11-05T20:46:25.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v7": { "createdDate": "2019-11-05T22:12:45.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2018-11-15T21:32:53.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ], "Version": "2012-10-17" } }, "v9": { "createdDate": "2020-01-02T20:18:38.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v8": { "createdDate": "2019-11-25T20:36:49.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v10": { "createdDate": "2020-04-02T17:19:29.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v11": { "createdDate": "2020-07-21T04:23:02.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v12": { "createdDate": "2020-07-30T18:25:47.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:StartBuildBatch", "codebuild:StopBuildBatch", "codebuild:RetryBuild", "codebuild:RetryBuildBatch", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v13": { "createdDate": "2020-09-14T16:03:44.000Z", "document": { "Statement": [ { "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:StartBuildBatch", "codebuild:StopBuildBatch", "codebuild:RetryBuild", "codebuild:RetryBuildBatch", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v14": { "createdDate": "2023-07-31T23:06:10.000Z", "document": { "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:StartBuildBatch", "codebuild:StopBuildBatch", "codebuild:RetryBuild", "codebuild:RetryBuildBatch", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v15": { "createdDate": "2016-12-01T19:02:32.000Z", "document": { "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:StartBuildBatch", "codebuild:StopBuildBatch", "codebuild:RetryBuild", "codebuild:RetryBuildBatch", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v16": { "createdDate": "2016-12-01T19:02:32.000Z", "document": { "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:StartBuildBatch", "codebuild:StopBuildBatch", "codebuild:RetryBuild", "codebuild:RetryBuildBatch", "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*:*:project/*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } } }, "createdDate": "2016-12-01T19:02:32.000Z", "lastUpdatedDate": "2024-12-16T20:07:06.000Z" }, "AWSCodeBuildReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeBuildReadOnlyAccess", "latestVersionId": "v13", "versionsCount": 13, "versions": { "v1": { "createdDate": "2016-12-01T19:03:41.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2018-11-15T21:38:34.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2018-10-03T19:36:58.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:Get*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2019-10-08T20:26:25.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" } }, "v6": { "createdDate": "2019-11-05T22:11:42.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v5": { "createdDate": "2019-11-05T20:48:33.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v7": { "createdDate": "2019-11-25T20:37:05.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:List*", "codebuild:DescribeTestCases", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v8": { "createdDate": "2020-01-02T20:06:42.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v9": { "createdDate": "2020-04-02T16:49:01.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v10": { "createdDate": "2020-07-30T18:28:43.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v11": { "createdDate": "2020-09-14T16:04:04.000Z", "document": { "Statement": [ { "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v12": { "createdDate": "2016-12-01T19:03:41.000Z", "document": { "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v13": { "createdDate": "2016-12-01T19:03:41.000Z", "document": { "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:BatchGet*", "codebuild:GetResourcePolicy", "codebuild:List*", "codebuild:DescribeTestCases", "codebuild:DescribeCodeCoverages", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "cloudwatch:GetMetricStatistics", "events:DescribeRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CodeStarConnectionsUserAccess", "Effect": "Allow", "Action": [ "codestar-connections:ListConnections", "codestar-connections:GetConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsPowerUserAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*:*:project/*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Resource": "*" } ], "Version": "2012-10-17" } } }, "createdDate": "2016-12-01T19:03:41.000Z", "lastUpdatedDate": "2024-12-16T19:52:06.000Z" }, "AWSCodeBuildAdminAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2016-12-01T19:04:44.000Z", "document": { "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "ecr:DescribeRepositories", "ecr:ListImages", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2017-10-25T19:39:52.000Z", "document": { "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "ecr:DescribeRepositories", "ecr:ListImages", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2018-07-19T18:19:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ] } }, "v3": { "createdDate": "2017-11-21T19:07:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ] } }, "v5": { "createdDate": "2018-10-03T18:20:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ] } }, "v6": { "createdDate": "2018-11-15T21:21:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" } ] } }, "v7": { "createdDate": "2019-11-05T20:40:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-11-05T22:12:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-02-06T20:26:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2020-04-02T17:21:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2020-07-21T04:22:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2020-09-14T16:03:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-connections:CreateConnection", "codestar-connections:DeleteConnection", "codestar-connections:UpdateConnectionInstallation", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListConnections", "codestar-connections:ListInstallationTargets", "codestar-connections:ListTagsForResource", "codestar-connections:GetConnection", "codestar-connections:GetIndividualAccessToken", "codestar-connections:GetInstallationUrl", "codestar-connections:PassConnection", "codestar-connections:StartOAuthHandshake", "codestar-connections:UseConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2023-07-31T23:06:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CWLDeleteLogGroupAccess", "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-connections:CreateConnection", "codestar-connections:DeleteConnection", "codestar-connections:UpdateConnectionInstallation", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListConnections", "codestar-connections:ListInstallationTargets", "codestar-connections:ListTagsForResource", "codestar-connections:GetConnection", "codestar-connections:GetIndividualAccessToken", "codestar-connections:GetInstallationUrl", "codestar-connections:PassConnection", "codestar-connections:StartOAuthHandshake", "codestar-connections:UseConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2016-12-01T19:04:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CWLDeleteLogGroupAccess", "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-connections:CreateConnection", "codestar-connections:DeleteConnection", "codestar-connections:UpdateConnectionInstallation", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListConnections", "codestar-connections:ListInstallationTargets", "codestar-connections:ListTagsForResource", "codestar-connections:GetConnection", "codestar-connections:GetIndividualAccessToken", "codestar-connections:GetInstallationUrl", "codestar-connections:PassConnection", "codestar-connections:StartOAuthHandshake", "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2016-12-01T19:04:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSServicesAccess", "Action": [ "codebuild:*", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cloudwatch:GetMetricStatistics", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ecr:DescribeRepositories", "ecr:ListImages", "elasticfilesystem:DescribeFileSystems", "events:DeleteRule", "events:DescribeRule", "events:DisableRule", "events:EnableRule", "events:ListTargetsByRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "logs:GetLogEvents", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "CWLDeleteLogGroupAccess", "Action": [ "logs:DeleteLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*" }, { "Sid": "SSMParameterWriteAccess", "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/CodeBuild/*" }, { "Sid": "SSMStartSessionAccess", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "CodeStarConnectionsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-connections:CreateConnection", "codestar-connections:DeleteConnection", "codestar-connections:UpdateConnectionInstallation", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListConnections", "codestar-connections:ListInstallationTargets", "codestar-connections:ListTagsForResource", "codestar-connections:GetConnection", "codestar-connections:GetIndividualAccessToken", "codestar-connections:GetInstallationUrl", "codestar-connections:PassConnection", "codestar-connections:StartOAuthHandshake", "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "ArnLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codebuild:*:*:project/*" } } }, { "Sid": "CodeStarNotificationsListAccess", "Effect": "Allow", "Action": [ "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "SNSTopicListAccess", "Effect": "Allow", "Action": [ "sns:ListTopics", "sns:GetTopicAttributes" ], "Resource": "*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ] } } }, "createdDate": "2016-12-01T19:04:44.000Z", "lastUpdatedDate": "2024-12-16T20:07:07.000Z" }, "AmazonSSMAutomationRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2016-12-05T22:09:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:Automation*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-02-23T22:17:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:Automation*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DeleteSnapshot", "ec2:StartInstances", "ec2:RunInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2017-04-25T21:43:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:Automation*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DeleteSnapshot", "ec2:StartInstances", "ec2:RunInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeTags", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2017-06-06T00:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:Automation*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DeleteSnapshot", "ec2:StartInstances", "ec2:RunInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeTags", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2017-07-24T23:29:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:Automation*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:CopyImage", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DeleteSnapshot", "ec2:StartInstances", "ec2:RunInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeTags", "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:Automation*" ] } ] } } }, "createdDate": "2016-12-05T22:09:55.000Z", "lastUpdatedDate": "2017-07-24T23:29:12.000Z" }, "AWSLambdaENIManagementAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2016-12-06T00:37:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-10-01T20:07:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" } ] } } }, "createdDate": "2016-12-06T00:37:27.000Z", "lastUpdatedDate": "2020-10-01T20:07:26.000Z" }, "AWSHealthFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSHealthFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2016-12-06T12:30:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "health:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-12-22T14:25:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "health.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "health:*", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "health.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-11-16T18:11:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "health.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "health:*", "organizations:ListAccounts", "organizations:ListParents", "organizations:DescribeAccount", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "health.amazonaws.com" } } } ] } } }, "createdDate": "2016-12-06T12:30:31.000Z", "lastUpdatedDate": "2020-11-16T18:11:34.000Z" }, "AWSBatchFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSBatchFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2016-12-06T19:35:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] } ] } }, "v2": { "createdDate": "2016-12-13T00:38:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] } ] } }, "v3": { "createdDate": "2018-04-04T22:58:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] } ] } }, "v4": { "createdDate": "2018-06-12T17:46:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] } ] } }, "v5": { "createdDate": "2018-11-05T21:09:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] } ] } }, "v6": { "createdDate": "2021-03-10T07:02:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/*Batch*", "Condition": { "StringEquals": { "iam:AWSServiceName": "batch.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2022-10-24T16:09:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/*Batch*", "Condition": { "StringEquals": { "iam:AWSServiceName": "batch.amazonaws.com" } } } ] } } }, "createdDate": "2016-12-06T19:35:42.000Z", "lastUpdatedDate": "2022-10-24T16:09:09.000Z" }, "AWSBatchServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole", "latestVersionId": "v13", "versionsCount": 13, "versions": { "v2": { "createdDate": "2016-12-13T00:38:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinitions", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "iam:GetInstanceProfile", "iam:PassRole" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2016-12-06T19:36:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeSpotFleet", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinitions", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "iam:GetInstanceProfile", "iam:PassRole" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-03-30T23:26:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinitions", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:PassRole" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-05-11T20:44:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:PassRole" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-12-14T23:11:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole", "iam:PassRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*", "Condition": { "StringLike": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet*", "Condition": { "StringLike": { "iam:AWSServiceName": "spotfleet.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2018-03-21T21:28:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2018-10-11T02:26:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v8": { "createdDate": "2018-10-24T00:26:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v9": { "createdDate": "2018-10-30T19:00:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v10": { "createdDate": "2019-10-08T19:31:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v11": { "createdDate": "2020-11-23T18:19:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListAccountSettings", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ecs:TagResource", "Resource": [ "arn:aws:ecs:*:*:task/*_Batch_*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v12": { "createdDate": "2021-12-07T02:22:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListAccountSettings", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ecs:TagResource", "Resource": [ "arn:aws:ecs:*:*:task/*_Batch_*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } }, "v13": { "createdDate": "2016-12-06T19:36:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSBatchPolicyStatement1", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:TerminateInstances", "ec2:RunInstances", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListAccountSettings", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask", "ecs:UpdateContainerAgent", "ecs:DeregisterContainerInstance", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Sid": "AWSBatchPolicyStatement2", "Effect": "Allow", "Action": "ecs:TagResource", "Resource": [ "arn:aws:ecs:*:*:task/*_Batch_*" ] }, { "Sid": "AWSBatchPolicyStatement3", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Sid": "AWSBatchPolicyStatement4", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Sid": "AWSBatchPolicyStatement5", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } } }, "createdDate": "2016-12-06T19:36:24.000Z", "lastUpdatedDate": "2023-12-05T18:49:44.000Z" }, "AWSQuicksightAthenaAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2016-12-09T02:31:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetTable", "athena:GetTables", "athena:RunQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v2": { "createdDate": "2017-06-20T20:57:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v3": { "createdDate": "2017-08-11T23:37:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v4": { "createdDate": "2018-08-07T20:24:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] } ] } }, "v5": { "createdDate": "2019-08-08T17:51:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-09-10T17:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:GetWorkGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2020-06-25T16:24:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:GetWorkGroup", "athena:GetDataCatalog", "athena:GetDatabase", "athena:GetTableMetadata" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2020-11-11T02:12:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:GetWorkGroup", "athena:GetDataCatalog", "athena:GetDatabase", "athena:GetTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2021-01-29T02:07:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:ListEngineVersions", "athena:GetWorkGroup", "athena:GetDataCatalog", "athena:GetDatabase", "athena:GetTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2021-07-07T20:09:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:ListEngineVersions", "athena:GetWorkGroup", "athena:GetDataCatalog", "athena:GetDatabase", "athena:GetTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2016-12-09T02:31:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:CancelQueryExecution", "athena:GetCatalogs", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "athena:GetNamespace", "athena:GetNamespaces", "athena:GetQueryExecution", "athena:GetQueryExecutions", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetTable", "athena:GetTables", "athena:ListQueryExecutions", "athena:RunQuery", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:ListWorkGroups", "athena:ListEngineVersions", "athena:GetWorkGroup", "athena:GetDataCatalog", "athena:GetDatabase", "athena:GetTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-athena-query-results-*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2016-12-09T02:31:03.000Z", "lastUpdatedDate": "2025-01-03T00:22:06.000Z" }, "IAMSelfManageServiceSpecificCredentials": { "arn": "arn:aws:iam::aws:policy/IAMSelfManageServiceSpecificCredentials", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2016-12-22T17:25:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateServiceSpecificCredential", "iam:ListServiceSpecificCredentials", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential" ], "Resource": "arn:aws:iam::*:user/${aws:username}" } ] } } }, "createdDate": "2016-12-22T17:25:18.000Z", "lastUpdatedDate": "2016-12-22T17:25:18.000Z" }, "AWSStepFunctionsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSStepFunctionsReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-01-11T21:46:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:ListActivities", "states:DescribeStateMachine", "states:ListExecutions", "states:DescribeExecution", "states:GetExecutionHistory", "states:DescribeActivity" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-10T22:03:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:ListActivities", "states:DescribeStateMachine", "states:DescribeStateMachineForExecution", "states:ListExecutions", "states:DescribeExecution", "states:GetExecutionHistory", "states:DescribeActivity" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2017-01-11T21:46:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:ListActivities", "states:DescribeStateMachine", "states:DescribeStateMachineForExecution", "states:ListExecutions", "states:DescribeExecution", "states:GetExecutionHistory", "states:DescribeActivity", "states:ListTagsForResource", "states:DescribeMapRun", "states:ListMapRuns", "states:DescribeStateMachineAlias", "states:ListStateMachineAliases", "states:ListStateMachineVersions" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-01-11T21:46:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:ListActivities", "states:DescribeStateMachine", "states:DescribeStateMachineForExecution", "states:ListExecutions", "states:DescribeExecution", "states:GetExecutionHistory", "states:DescribeActivity", "states:ListTagsForResource", "states:DescribeMapRun", "states:ListMapRuns", "states:DescribeStateMachineAlias", "states:ListStateMachineAliases", "states:ListStateMachineVersions", "states:ValidateStateMachineDefinition" ], "Resource": "*" } ] } } }, "createdDate": "2017-01-11T21:46:19.000Z", "lastUpdatedDate": "2024-04-26T18:53:54.000Z" }, "AWSStepFunctionsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSStepFunctionsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-01-11T21:51:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "states:*", "Resource": "*" } ] } } }, "createdDate": "2017-01-11T21:51:32.000Z", "lastUpdatedDate": "2017-01-11T21:51:32.000Z" }, "AWSStepFunctionsConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSStepFunctionsConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-01-11T21:54:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "states:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam:::role/service-role/StatesExecutionRole*" }, { "Effect": "Allow", "Action": "lambda:ListFunctions", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-01-12T00:19:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "states:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/StatesExecutionRole*" }, { "Effect": "Allow", "Action": "lambda:ListFunctions", "Resource": "*" } ] } } }, "createdDate": "2017-01-11T21:54:31.000Z", "lastUpdatedDate": "2017-01-12T00:19:34.000Z" }, "AutoScalingFullAccess": { "arn": "arn:aws:iam::aws:policy/AutoScalingFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2018-02-06T21:59:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricAlarm", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribePlacementGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2017-01-12T19:31:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricAlarm", "Resource": "*" } ] } } }, "createdDate": "2017-01-12T19:31:58.000Z", "lastUpdatedDate": "2018-02-06T21:59:13.000Z" }, "AutoScalingReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-01-12T19:39:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" } ] } } }, "createdDate": "2017-01-12T19:39:35.000Z", "lastUpdatedDate": "2017-01-12T19:39:35.000Z" }, "AutoScalingConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AutoScalingConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-01-12T19:43:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateKeyPair", "ec2:CreateSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:ImportKeyPair" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListSubscriptions", "sns:ListTopics" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-02-06T23:15:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateKeyPair", "ec2:CreateSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribePlacementGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:ImportKeyPair" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListSubscriptions", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } } ] } } }, "createdDate": "2017-01-12T19:43:16.000Z", "lastUpdatedDate": "2018-02-06T23:15:36.000Z" }, "AutoScalingConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AutoScalingConsoleReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-01-12T19:48:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListSubscriptions", "sns:ListTopics" ], "Resource": "*" } ] } } }, "createdDate": "2017-01-12T19:48:53.000Z", "lastUpdatedDate": "2017-01-12T19:48:53.000Z" }, "AWSDataPipeline_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataPipeline_FullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-01-19T23:14:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:List*", "dynamodb:DescribeTable", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "sns:ListTopics", "sns:Subscribe", "iam:ListRoles", "iam:GetRolePolicy", "iam:GetInstanceProfiles", "iam:ListInstanceProfiles", "datapipeline:*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/DataPipelineDefaultRole" ] } ] } }, "v2": { "createdDate": "2017-08-17T18:48:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:List*", "dynamodb:DescribeTable", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "sns:ListTopics", "sns:Subscribe", "iam:ListRoles", "iam:GetRolePolicy", "iam:GetInstanceProfile", "iam:ListInstanceProfiles", "datapipeline:*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/DataPipelineDefaultRole" ] } ] } } }, "createdDate": "2017-01-19T23:14:54.000Z", "lastUpdatedDate": "2017-08-17T18:48:39.000Z" }, "AWSDataPipeline_PowerUser": { "arn": "arn:aws:iam::aws:policy/AWSDataPipeline_PowerUser", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-01-19T23:16:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:List*", "dynamodb:DescribeTable", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "sns:ListTopics", "iam:ListRoles", "iam:GetRolePolicy", "iam:GetInstanceProfiles", "iam:ListInstanceProfiles", "datapipeline:*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/DataPipelineDefaultRole" ] } ] } }, "v2": { "createdDate": "2017-08-17T18:49:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:List*", "dynamodb:DescribeTable", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "sns:ListTopics", "iam:ListRoles", "iam:GetRolePolicy", "iam:GetInstanceProfile", "iam:ListInstanceProfiles", "datapipeline:*" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/DataPipelineDefaultResourceRole", "arn:aws:iam::*:role/DataPipelineDefaultRole" ] } ] } } }, "createdDate": "2017-01-19T23:16:46.000Z", "lastUpdatedDate": "2017-08-17T18:49:42.000Z" }, "ApplicationAutoScalingForAmazonAppStreamAccess": { "arn": "arn:aws:iam::aws:policy/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-02-06T21:39:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appstream:UpdateFleet", "appstream:DescribeFleets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-02-06T21:39:56.000Z", "lastUpdatedDate": "2017-02-06T21:39:56.000Z" }, "AWSGreengrassResourceAccessRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSGreengrassResourceAccessRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-02-14T21:17:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1485992727244", "Action": [ "iot:DeleteThingShadow", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:thing/GG_*" }, { "Sid": "Stmt1485992772458", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-05-02T22:09:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGreengrassAccessToShadows", "Action": [ "iot:DeleteThingShadow", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": [ "arn:aws:iot:*:*:thing/GG_*", "arn:aws:iot:*:*:thing/*-gcm", "arn:aws:iot:*:*:thing/*-gda", "arn:aws:iot:*:*:thing/*-gci" ] }, { "Sid": "AllowGreengrassToCallGreengrassServices", "Action": [ "greengrass:*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassToGetLambdaFunctions", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2017-05-26T23:10:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGreengrassAccessToShadows", "Action": [ "iot:DeleteThingShadow", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": [ "arn:aws:iot:*:*:thing/GG_*", "arn:aws:iot:*:*:thing/*-gcm", "arn:aws:iot:*:*:thing/*-gda", "arn:aws:iot:*:*:thing/*-gci" ] }, { "Sid": "AllowGreengrassToDescribeThings", "Action": [ "iot:DescribeThing" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:thing/*" }, { "Sid": "AllowGreengrassToDescribeCertificates", "Action": [ "iot:DescribeCertificate" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:cert/*" }, { "Sid": "AllowGreengrassToCallGreengrassServices", "Action": [ "greengrass:*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassToGetLambdaFunctions", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2018-11-14T00:35:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGreengrassAccessToShadows", "Action": [ "iot:DeleteThingShadow", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": [ "arn:aws:iot:*:*:thing/GG_*", "arn:aws:iot:*:*:thing/*-gcm", "arn:aws:iot:*:*:thing/*-gda", "arn:aws:iot:*:*:thing/*-gci" ] }, { "Sid": "AllowGreengrassToDescribeThings", "Action": [ "iot:DescribeThing" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:thing/*" }, { "Sid": "AllowGreengrassToDescribeCertificates", "Action": [ "iot:DescribeCertificate" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:cert/*" }, { "Sid": "AllowGreengrassToCallGreengrassServices", "Action": [ "greengrass:*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassToGetLambdaFunctions", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassToGetGreengrassSecrets", "Action": [ "secretsmanager:GetSecretValue" ], "Effect": "Allow", "Resource": "arn:aws:secretsmanager:*:*:secret:greengrass-*" }, { "Sid": "AllowGreengrassAccessToS3Objects", "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::*Greengrass*", "arn:aws:s3:::*GreenGrass*", "arn:aws:s3:::*greengrass*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowGreengrassAccessToS3BucketLocation", "Action": [ "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassAccessToSageMakerTrainingJobs", "Action": [ "sagemaker:DescribeTrainingJob" ], "Effect": "Allow", "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] } ] } }, "v4": { "createdDate": "2018-03-28T17:32:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGreengrassAccessToShadows", "Action": [ "iot:DeleteThingShadow", "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": [ "arn:aws:iot:*:*:thing/GG_*", "arn:aws:iot:*:*:thing/*-gcm", "arn:aws:iot:*:*:thing/*-gda", "arn:aws:iot:*:*:thing/*-gci" ] }, { "Sid": "AllowGreengrassToDescribeThings", "Action": [ "iot:DescribeThing" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:thing/*" }, { "Sid": "AllowGreengrassToDescribeCertificates", "Action": [ "iot:DescribeCertificate" ], "Effect": "Allow", "Resource": "arn:aws:iot:*:*:cert/*" }, { "Sid": "AllowGreengrassToCallGreengrassServices", "Action": [ "greengrass:*" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassToGetLambdaFunctions", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassAccessToS3Objects", "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::*Greengrass*", "arn:aws:s3:::*GreenGrass*", "arn:aws:s3:::*greengrass*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowGreengrassAccessToS3BucketLocation", "Action": [ "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "AllowGreengrassAccessToSageMakerTrainingJobs", "Action": [ "sagemaker:DescribeTrainingJob" ], "Effect": "Allow", "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] } ] } } }, "createdDate": "2017-02-14T21:17:24.000Z", "lastUpdatedDate": "2018-11-14T00:35:02.000Z" }, "AWSElasticBeanstalkCustomPlatformforEC2Role": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkCustomPlatformforEC2Role", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-02-21T22:50:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Access", "Action": [ "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateKeypair", "ec2:CreateSecurityGroup", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteKeypair", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeleteVolume", "ec2:DeregisterImage", "ec2:DescribeImageAttribute", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DetachVolume", "ec2:GetPasswordData", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:ModifySnapshotAttribute", "ec2:RegisterImage", "ec2:RunInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "BucketAccess", "Action": [ "s3:Get*", "s3:List*", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "CloudWatchLogsAccess", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/platform/*" } ] } } }, "createdDate": "2017-02-21T22:50:30.000Z", "lastUpdatedDate": "2017-02-21T22:50:30.000Z" }, "AmazonCloudDirectoryFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudDirectoryFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-02-25T00:41:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "clouddirectory:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-02-25T00:41:39.000Z", "lastUpdatedDate": "2017-02-25T00:41:39.000Z" }, "AmazonCloudDirectoryReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudDirectoryReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-02-28T23:42:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "clouddirectory:List*", "clouddirectory:Get*", "clouddirectory:LookupPolicy", "clouddirectory:BatchRead" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-02-28T23:42:06.000Z", "lastUpdatedDate": "2017-02-28T23:42:06.000Z" }, "AWSMarketplaceGetEntitlements": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceGetEntitlements", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-03-27T19:37:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:GetEntitlements" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-03-27T19:37:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSMarketplaceGetEntitlements", "Effect": "Allow", "Action": [ "aws-marketplace:GetEntitlements" ], "Resource": "*" } ] } } }, "createdDate": "2017-03-27T19:37:24.000Z", "lastUpdatedDate": "2024-04-05T01:27:20.000Z" }, "AWSOpsWorksCloudWatchLogs": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorksCloudWatchLogs", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-03-30T17:47:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*" ] } ] } } }, "createdDate": "2017-03-30T17:47:19.000Z", "lastUpdatedDate": "2017-03-30T17:47:19.000Z" }, "AmazonLexRunBotsOnly": { "arn": "arn:aws:iam::aws:policy/AmazonLexRunBotsOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-04-11T23:06:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lex:PostContent", "lex:PostText" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-12T19:26:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lex:PostContent", "lex:PostText", "lex:PutSession", "lex:GetSession", "lex:DeleteSession" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-08-18T00:15:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lex:PostContent", "lex:PostText", "lex:PutSession", "lex:GetSession", "lex:DeleteSession", "lex:RecognizeText", "lex:RecognizeUtterance", "lex:StartConversation" ], "Resource": "*" } ] } } }, "createdDate": "2017-04-11T23:06:24.000Z", "lastUpdatedDate": "2021-08-18T00:15:48.000Z" }, "AmazonLexReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonLexReadOnly", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-04-11T23:13:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lex:GetBot", "lex:GetBotAlias", "lex:GetBotAliases", "lex:GetBots", "lex:GetBotChannelAssociation", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "lex:GetIntent", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2021-07-26T22:04:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lex:GetBot", "lex:GetBotAlias", "lex:GetBotAliases", "lex:GetBots", "lex:GetBotChannelAssociation", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "lex:GetIntent", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:ListBots", "lex:ListBotLocales", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-04-27T23:43:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lex:GetBot", "lex:GetBotAlias", "lex:GetBotAliases", "lex:GetBots", "lex:GetBotChannelAssociation", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "lex:GetIntent", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotRecommendation", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:ListBots", "lex:ListBotLocales", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotRecommendations", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListRecommendedIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "lex:SearchAssociatedTranscripts" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-01-31T19:31:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lex:GetBot", "lex:GetBotAlias", "lex:GetBotAliases", "lex:GetBots", "lex:GetBotChannelAssociation", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "lex:GetIntent", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotRecommendation", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:ListBots", "lex:ListBotLocales", "lex:ListBotAliases", "lex:ListBotChannels", "lex:ListBotRecommendations", "lex:ListBotVersions", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListRecommendedIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "lex:SearchAssociatedTranscripts", "lex:ListCustomVocabularyItems" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2017-04-11T23:13:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonLexReadOnlyStatement1", "Effect": "Allow", "Action": [ "lex:GetBot", "lex:GetBotAlias", "lex:GetBotAliases", "lex:GetBots", "lex:GetBotChannelAssociation", "lex:GetBotChannelAssociations", "lex:GetBotVersions", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "lex:GetIntent", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotType", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotChannel", "lex:DescribeBotLocale", "lex:DescribeBotRecommendation", "lex:DescribeBotReplica", "lex:DescribeBotVersion", "lex:DescribeExport", "lex:DescribeImport", "lex:DescribeIntent", "lex:DescribeResourcePolicy", "lex:DescribeSlot", "lex:DescribeSlotType", "lex:ListBots", "lex:ListBotLocales", "lex:ListBotAliases", "lex:ListBotAliasReplicas", "lex:ListBotChannels", "lex:ListBotRecommendations", "lex:ListBotReplicas", "lex:ListBotVersions", "lex:ListBotVersionReplicas", "lex:ListBuiltInIntents", "lex:ListBuiltInSlotTypes", "lex:ListExports", "lex:ListImports", "lex:ListIntents", "lex:ListRecommendedIntents", "lex:ListSlots", "lex:ListSlotTypes", "lex:ListTagsForResource", "lex:SearchAssociatedTranscripts", "lex:ListCustomVocabularyItems" ], "Resource": "*" } ] } } }, "createdDate": "2017-04-11T23:13:33.000Z", "lastUpdatedDate": "2024-05-13T16:58:13.000Z" }, "AmazonLexFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLexFullAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2017-04-11T23:20:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v2": { "createdDate": "2017-04-12T20:16:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v3": { "createdDate": "2017-04-14T19:45:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v4": { "createdDate": "2017-11-15T23:55:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ] }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v5": { "createdDate": "2020-05-15T16:34:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "kendra:ListIndices", "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ] }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v6": { "createdDate": "2020-05-29T15:21:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "kendra:ListIndices", "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringLike": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ] }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexBotPolicy" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ] }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringLike": { "iam:PassedToService": [ "lex.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringLike": { "iam:PolicyArn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy" } } } ] } }, "v7": { "createdDate": "2021-07-26T21:48:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech", "kendra:ListIndices", "iam:ListRoles", "s3:ListAllMyBuckets", "logs:DescribeLogGroups", "s3:GetBucketLocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringEquals": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lexv2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lexv2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lex.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lexv2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "channels.lexv2.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2017-04-11T23:20:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonLexFullAccessStatement1", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech", "kendra:ListIndices", "iam:ListRoles", "s3:ListAllMyBuckets", "logs:DescribeLogGroups", "s3:GetBucketLocation" ], "Resource": [ "*" ] }, { "Sid": "AmazonLexFullAccessStatement2", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringEquals": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement3", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*", "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ] }, { "Sid": "AmazonLexFullAccessStatement4", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement5", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement6", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement7", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement8", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement9", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*", "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ] }, { "Sid": "AmazonLexFullAccessStatement10", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lex.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement11", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lexv2.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement12", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "channels.lexv2.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement13", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lexv2.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2017-04-11T23:20:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonLexFullAccessStatement1", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "kms:DescribeKey", "kms:ListAliases", "lambda:GetPolicy", "lambda:ListFunctions", "lex:*", "polly:DescribeVoices", "polly:SynthesizeSpeech", "kendra:ListIndices", "iam:ListRoles", "s3:ListAllMyBuckets", "logs:DescribeLogGroups", "s3:GetBucketLocation" ], "Resource": [ "*" ] }, { "Sid": "AmazonLexFullAccessStatement2", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:AmazonLex*", "Condition": { "StringEquals": { "lambda:Principal": "lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement3", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*", "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ] }, { "Sid": "AmazonLexFullAccessStatement4", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement5", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lex.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement6", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement7", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "channels.lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement8", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "replication.lexv2.amazonaws.com" } } }, { "Sid": "AmazonLexFullAccessStatement9", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots", "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels", "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*", "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*", "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ] }, { "Sid": "AmazonLexFullAccessStatement10", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lex.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement11", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lexv2.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement12", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "channels.lexv2.amazonaws.com" ] } } }, { "Sid": "AmazonLexFullAccessStatement13", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lexv2.amazonaws.com" ] } } } ] } } }, "createdDate": "2017-04-11T23:20:36.000Z", "lastUpdatedDate": "2024-04-16T20:06:39.000Z" }, "AWSCodeStarServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCodeStarServiceRole", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2017-04-19T15:20:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role" ] } ] } }, "v2": { "createdDate": "2017-07-13T19:53:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] } ] } }, "v3": { "createdDate": "2017-11-14T18:30:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] } ] } }, "v4": { "createdDate": "2017-11-30T14:33:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2018-01-08T22:55:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "arn:aws:config:*:*:config-rule/config-rule-*" ] } ] } }, "v6": { "createdDate": "2018-01-11T19:19:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*Project", "codestar:*Resource*", "codestar:List*", "codestar:Describe*", "codestar:Get*", "codestar:AssociateTeamMember", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2018-10-04T19:28:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2018-02-12T23:20:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2021-09-20T19:11:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::elasticbeanstalk-*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:GetRolePolicy", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] }, { "Sid": "ProjectCodeStarConnections", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codestar-connections:GetConnection" ], "Resource": "*" }, { "Sid": "ProjectCodeStarConnectionsPassConnections", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "*", "Condition": { "StringEqualsIfExists": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2019-04-24T19:25:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:GetRolePolicy", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2021-02-15T22:25:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProjectEventRules", "Effect": "Allow", "Action": [ "events:PutTargets", "events:RemoveTargets", "events:PutRule", "events:DeleteRule", "events:DescribeRule" ], "Resource": [ "arn:aws:events:*:*:rule/awscodestar-*" ] }, { "Sid": "ProjectStack", "Effect": "Allow", "Action": [ "cloudformation:*Stack*", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*", "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/aws-cloud9-*", "arn:aws:cloudformation:*:aws:transform/CodeStar*" ] }, { "Sid": "ProjectStackTemplate", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "ProjectQuickstarts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awscodestar-*/*" ] }, { "Sid": "ProjectS3Buckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::aws-codestar-*", "arn:aws:s3:::aws-codestar-*/*", "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "ProjectServices", "Effect": "Allow", "Action": [ "codestar:*", "codecommit:*", "codepipeline:*", "codedeploy:*", "codebuild:*", "ec2:RunInstances", "autoscaling:*", "cloudwatch:Put*", "ec2:*", "elasticbeanstalk:*", "elasticloadbalancing:*", "iam:ListRoles", "logs:*", "sns:*", "cloud9:CreateEnvironmentEC2", "cloud9:DeleteEnvironment", "cloud9:DescribeEnvironment*", "cloud9:ListEnvironments" ], "Resource": "*" }, { "Sid": "ProjectWorkerRoles", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:PassRole", "iam:GetRolePolicy", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:CreatePolicy", "iam:DeletePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/CodeStarWorker*", "arn:aws:iam::*:policy/CodeStarWorker*", "arn:aws:iam::*:instance-profile/awscodestar-*" ] }, { "Sid": "ProjectTeamMembers", "Effect": "Allow", "Action": [ "iam:AttachUserPolicy", "iam:DetachUserPolicy" ], "Resource": "*", "Condition": { "ArnEquals": { "iam:PolicyArn": [ "arn:aws:iam::*:policy/CodeStar_*" ] } } }, { "Sid": "ProjectRoles", "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:DeletePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/CodeStar_*" ] }, { "Sid": "InspectServiceRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-codestar-service-role", "arn:aws:iam::*:role/service-role/aws-codestar-service-role" ] }, { "Sid": "IAMLinkRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Sid": "DescribeConfigRuleForARN", "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": [ "*" ] }, { "Sid": "ProjectCodeStarConnections", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codestar-connections:GetConnection" ], "Resource": "*" }, { "Sid": "ProjectCodeStarConnectionsPassConnections", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "*", "Condition": { "ForAnyValue:StringEqualsIfExists": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } } }, "createdDate": "2017-04-19T15:20:50.000Z", "lastUpdatedDate": "2021-09-20T19:11:03.000Z" }, "AWSCodeStarFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeStarFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-04-19T16:23:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeStarEC2", "Effect": "Allow", "Action": [ "codestar:*", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "CodeStarCF", "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*" ] } ] } }, "v3": { "createdDate": "2023-03-28T00:06:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeStarEC2", "Effect": "Allow", "Action": [ "codestar:*", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "cloud9:DescribeEnvironment*", "cloud9:ValidateEnvironmentName" ], "Resource": "*" }, { "Sid": "CodeStarCF", "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:ListStacks*", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*" ] } ] } }, "v2": { "createdDate": "2018-01-10T21:54:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeStarEC2", "Effect": "Allow", "Action": [ "codestar:*", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "cloud9:DescribeEnvironment*", "cloud9:ValidateEnvironmentName" ], "Resource": "*" }, { "Sid": "CodeStarCF", "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awscodestar-*" ] } ] } } }, "createdDate": "2017-04-19T16:23:19.000Z", "lastUpdatedDate": "2023-03-28T00:06:28.000Z" }, "AWSGreengrassFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSGreengrassFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-05-03T00:47:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "greengrass:*" ], "Resource": "*" } ] } } }, "createdDate": "2017-05-03T00:47:37.000Z", "lastUpdatedDate": "2017-05-03T00:47:37.000Z" }, "AmazonEC2ContainerServiceEventsRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-05-30T16:51:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:RunTask" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2023-03-06T22:25:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:RunTask" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ecs:TagResource", "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "RunTask" ] } } } ] } }, "v2": { "createdDate": "2018-05-22T19:13:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:RunTask" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } } ] } } }, "createdDate": "2017-05-30T16:51:35.000Z", "lastUpdatedDate": "2023-03-06T22:25:12.000Z" }, "QuickSightAccessForS3StorageManagementAnalyticsReadOnly": { "arn": "arn:aws:iam::aws:policy/service-role/QuickSightAccessForS3StorageManagementAnalyticsReadOnly", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-06-12T18:18:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectMetadata" ], "Resource": [ "arn:aws:s3:::s3-analytics-export-shared-*" ] } ] } }, "v3": { "createdDate": "2017-07-21T00:02:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectMetadata" ], "Resource": [ "arn:aws:s3:::s3-analytics-export-shared-*" ] }, { "Action": [ "s3:GetAnalyticsConfiguration", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2019-10-08T23:53:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::s3-analytics-export-shared-*" ] }, { "Action": [ "s3:GetAnalyticsConfiguration", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-07-07T21:16:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectMetadata" ], "Resource": [ "arn:aws:s3:::s3-analytics-export-shared-*" ] }, { "Action": [ "s3:GetAnalyticsConfiguration", "s3:ListBuckets" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-06-12T18:18:38.000Z", "lastUpdatedDate": "2019-10-08T23:53:11.000Z" }, "AmazonEC2SpotFleetTaggingRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-06-29T18:19:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Condition": { "StringEquals": { "PassedToService": "ec2.amazonaws.com" } }, "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-07-26T19:10:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } }, "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2017-11-07T19:19:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2017-11-17T22:51:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2020-04-23T19:30:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:TerminateInstances", "ec2:DescribeInstanceStatus", "ec2:CreateTags", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*/*" ] } ] } } }, "createdDate": "2017-06-29T18:19:29.000Z", "lastUpdatedDate": "2020-04-23T19:30:49.000Z" }, "AmazonElasticsearchServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2017-07-07T00:15:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-02-08T21:38:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-08-31T10:30:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2022-08-02T15:31:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "Stmt1480452973135", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-09-12T15:01:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "Stmt1480452973135", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973136", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } } ] } }, "v6": { "createdDate": "2022-10-13T13:45:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "Stmt1480452973135", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973136", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } } ] } }, "v7": { "createdDate": "2017-07-07T00:15:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "Stmt1480452973135", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973136", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973149", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973150", "Effect": "Allow", "Action": [ "ec2:UnAssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } } ] } } }, "createdDate": "2017-07-07T00:15:31.000Z", "lastUpdatedDate": "2023-10-23T06:58:31.000Z" }, "AmazonVPCCrossAccountNetworkInterfaceOperations": { "arn": "arn:aws:iam::aws:policy/AmazonVPCCrossAccountNetworkInterfaceOperations", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-07-18T20:47:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ReplaceRoute" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-01-02T19:17:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ReplaceRoute" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfacePermissions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-01-07T19:16:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ReplaceRoute" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfacePermissions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2020-06-16T14:16:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ReplaceRoute" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfacePermissions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2017-07-18T20:47:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ReplaceRoute" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfacePermissions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-07-18T20:47:16.000Z", "lastUpdatedDate": "2023-09-25T15:12:17.000Z" }, "AmazonSSMAutomationApproverAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSSMAutomationApproverAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-08-07T23:07:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "ssm:SendAutomationSignal" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-08-07T23:07:28.000Z", "lastUpdatedDate": "2017-08-07T23:07:28.000Z" }, "AWSMigrationHubDiscoveryAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSMigrationHubDiscoveryAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-08-14T13:30:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-02-20T16:35:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": "dms:AddTagsToResource", "Resource": [ "arn:aws:dms:*:*:endpoint:*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } } ] } }, "v3": { "createdDate": "2020-08-06T17:34:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": "dms:AddTagsToResource", "Resource": [ "arn:aws:dms:*:*:endpoint:*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-08-14T13:30:51.000Z", "lastUpdatedDate": "2020-08-06T17:34:42.000Z" }, "AWSGlueServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-08-14T13:37:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteNetworkInterface" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v3": { "createdDate": "2017-08-23T21:35:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v2": { "createdDate": "2017-08-17T18:08:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteNetworkInterface" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v4": { "createdDate": "2018-06-25T18:23:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "cloudwatch:PutMetricData" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v5": { "createdDate": "2017-08-14T13:37:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "cloudwatch:PutMetricData" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2017-08-14T13:37:21.000Z", "lastUpdatedDate": "2023-09-11T16:39:47.000Z" }, "AWSGlueConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2017-08-14T13:37:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:RunInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-dev-endpoint" ] } }, "Resource": [ "*" ] }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2017-09-13T00:12:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:RunInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-dev-endpoint" ] } }, "Resource": [ "*" ] }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2017-09-26T19:08:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:RunInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-dev-endpoint" ] } }, "Resource": [ "*" ] }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2018-03-16T00:21:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:RunInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-dev-endpoint" ] } }, "Resource": [ "*" ] }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2018-03-26T19:54:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2018-05-07T21:23:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2018-03-26T19:52:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2018-06-22T20:26:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2018-07-20T22:13:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2018-10-26T22:15:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2019-02-07T19:37:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBSubnetGroups", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2023-03-30T15:58:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBSubnetGroups", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2019-02-11T19:49:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBSubnetGroups", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v14": { "createdDate": "2023-07-14T14:37:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BaseAppPermissions", "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBSubnetGroups", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:DescribeRecipe" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } } }, "createdDate": "2017-08-14T13:37:39.000Z", "lastUpdatedDate": "2023-07-14T14:37:54.000Z" }, "AWSGlueServiceNotebookRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSGlueServiceNotebookRole", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2017-08-17T18:08:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeleteDatabase", "glue:DeletePartition", "glue:DeleteTable", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTableVersions", "glue:GetTables", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "glue:CreateBookmark", "glue:GetBookmark", "glue:UpdateBookmark", "glue:GetMetric", "glue:PutMetric", "glue:CreateConnection", "glue:CreateJob", "glue:DeleteConnection", "glue:DeleteJob", "glue:GetConnection", "glue:GetConnections", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:UpdateJob", "glue:BatchDeleteConnection", "glue:UpdateConnection", "glue:GetUserDefinedFunction", "glue:UpdateUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:DeleteUserDefinedFunction", "glue:CreateUserDefinedFunction", "glue:BatchGetPartition", "glue:BatchDeletePartition", "glue:BatchCreatePartition", "glue:BatchDeleteTable", "glue:UpdateDevEndpoint", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v3": { "createdDate": "2019-10-07T18:05:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeleteDatabase", "glue:DeletePartition", "glue:DeleteTable", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTableVersions", "glue:GetTables", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "glue:CreateConnection", "glue:CreateJob", "glue:DeleteConnection", "glue:DeleteJob", "glue:GetConnection", "glue:GetConnections", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:UpdateJob", "glue:BatchDeleteConnection", "glue:UpdateConnection", "glue:GetUserDefinedFunction", "glue:UpdateUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:DeleteUserDefinedFunction", "glue:CreateUserDefinedFunction", "glue:BatchGetPartition", "glue:BatchDeletePartition", "glue:BatchCreatePartition", "glue:BatchDeleteTable", "glue:UpdateDevEndpoint", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v1": { "createdDate": "2017-08-14T13:37:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeleteDatabase", "glue:DeletePartition", "glue:DeleteTable", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTableVersions", "glue:GetTables", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "glue:CreateBookmark", "glue:GetBookmark", "glue:UpdateBookmark", "glue:GetMetric", "glue:PutMetric", "glue:CreateConnection", "glue:CreateJob", "glue:DeleteConnection", "glue:DeleteJob", "glue:GetConnection", "glue:GetConnections", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:UpdateJob", "glue:BatchDeleteConnection", "glue:UpdateConnection", "glue:GetUserDefinedFunction", "glue:UpdateUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:DeleteUserDefinedFunction", "glue:CreateUserDefinedFunction", "glue:BatchGetPartition", "glue:BatchDeletePartition", "glue:BatchCreatePartition", "glue:BatchDeleteTable", "glue:UpdateDevEndpoint", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v4": { "createdDate": "2017-08-14T13:37:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeleteDatabase", "glue:DeletePartition", "glue:DeleteTable", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTableVersions", "glue:GetTables", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "glue:CreateConnection", "glue:CreateJob", "glue:DeleteConnection", "glue:DeleteJob", "glue:GetConnection", "glue:GetConnections", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:UpdateJob", "glue:BatchDeleteConnection", "glue:UpdateConnection", "glue:GetUserDefinedFunction", "glue:UpdateUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:DeleteUserDefinedFunction", "glue:CreateUserDefinedFunction", "glue:BatchGetPartition", "glue:BatchDeletePartition", "glue:BatchCreatePartition", "glue:BatchDeleteTable", "glue:UpdateDevEndpoint", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "codewhisperer:GenerateRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*", "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2017-08-14T13:37:42.000Z", "lastUpdatedDate": "2023-10-09T15:59:41.000Z" }, "AWSMigrationHubSMSAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSMigrationHubSMSAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-08-14T13:57:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:CreateProgressUpdateStream" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS" }, { "Action": [ "mgh:AssociateCreatedArtifact", "mgh:DescribeMigrationTask", "mgh:DisassociateCreatedArtifact", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:AssociateDiscoveredResource", "mgh:DisassociateDiscoveredResource", "mgh:ListDiscoveredResources" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS/*" }, { "Action": [ "mgh:ListMigrationTasks" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T18:01:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:CreateProgressUpdateStream" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS" }, { "Action": [ "mgh:AssociateCreatedArtifact", "mgh:DescribeMigrationTask", "mgh:DisassociateCreatedArtifact", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:AssociateDiscoveredResource", "mgh:DisassociateDiscoveredResource", "mgh:ListDiscoveredResources" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS/*" }, { "Action": [ "mgh:ListMigrationTasks", "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-08-14T13:57:54.000Z", "lastUpdatedDate": "2019-10-07T18:01:22.000Z" }, "AWSMigrationHubDMSAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSMigrationHubDMSAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-08-14T14:00:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:CreateProgressUpdateStream" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS" }, { "Action": [ "mgh:AssociateCreatedArtifact", "mgh:DescribeMigrationTask", "mgh:DisassociateCreatedArtifact", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:AssociateDiscoveredResource", "mgh:DisassociateDiscoveredResource", "mgh:ListDiscoveredResources" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS/*" }, { "Action": [ "mgh:ListMigrationTasks" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T17:51:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:CreateProgressUpdateStream" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS" }, { "Action": [ "mgh:AssociateCreatedArtifact", "mgh:DescribeMigrationTask", "mgh:DisassociateCreatedArtifact", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:AssociateDiscoveredResource", "mgh:DisassociateDiscoveredResource", "mgh:ListDiscoveredResources" ], "Effect": "Allow", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS/*" }, { "Action": [ "mgh:ListMigrationTasks", "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-08-14T14:00:06.000Z", "lastUpdatedDate": "2019-10-07T17:51:53.000Z" }, "AWSMigrationHubFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2017-08-14T14:09:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2017-08-14T14:02:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-08-16T20:29:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*", "Condition": { "StringEquals": { "iam:AWSServiceName": "continuousexport.discovery.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*" } ] } }, "v4": { "createdDate": "2019-06-19T21:14:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mgh:*", "discovery:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*", "Condition": { "StringEquals": { "iam:AWSServiceName": "continuousexport.discovery.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/continuousexport.discovery.amazonaws.com/AWSServiceRoleForApplicationDiscoveryServiceContinuousExport*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "migrationhub.amazonaws.com", "dmsintegration.migrationhub.amazonaws.com", "smsintegration.migrationhub.amazonaws.com" ] } } } ] } } }, "createdDate": "2017-08-14T14:02:54.000Z", "lastUpdatedDate": "2019-06-19T21:14:41.000Z" }, "AmazonMacieServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonMacieServiceRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-08-14T14:53:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "s3:Get*", "s3:List*" ] } ] } } }, "createdDate": "2017-08-14T14:53:26.000Z", "lastUpdatedDate": "2017-08-14T14:53:26.000Z" }, "AmazonMacieFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMacieFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-08-14T14:54:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "macie:*" ] } ] } }, "v2": { "createdDate": "2018-06-28T15:54:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "macie:*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "macie.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-05-13T19:05:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "macie:*", "macie2:*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "macie.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-03-07T18:08:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "macie2:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/AWSServiceRoleForAmazonMacie", "Condition": { "StringLike": { "iam:AWSServiceName": "macie.amazonaws.com" } } }, { "Effect": "Allow", "Action": "pricing:GetProducts", "Resource": "*" } ] } }, "v5": { "createdDate": "2022-07-01T00:41:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "macie2:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie", "Condition": { "StringLike": { "iam:AWSServiceName": "macie.amazonaws.com" } } }, { "Effect": "Allow", "Action": "pricing:GetProducts", "Resource": "*" } ] } } }, "createdDate": "2017-08-14T14:54:30.000Z", "lastUpdatedDate": "2022-07-01T00:41:53.000Z" }, "AWSElasticBeanstalkServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticBeanstalkServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v2": { "createdDate": "2017-10-19T20:16:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalk", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "elasticbeanstalk.amazonaws.com" } } }, { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:PutNotificationConfiguration", "cloudwatch:PutMetricAlarm", "ec2:DescribeInstanceStatus", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeDBEngineVersions", "sns:ListTopics", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2017-09-13T23:46:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalk", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "elasticbeanstalk.amazonaws.com" } } }, { "Sid": "AllowCloudformationOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowDeleteCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*" ] }, { "Sid": "AllowS3OperationsOnElasticBeanstalkBuckets", "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*", "arn:aws:s3:::elasticbeanstalk-*/*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "autoscaling:DetachInstances", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "cloudwatch:PutMetricAlarm", "ec2:AssociateAddress", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:TerminateInstances", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:ListRoles", "logs:CreateLogGroup", "logs:PutRetentionPolicy", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeDBEngineVersions", "sns:ListTopics", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2017-12-06T22:30:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationReadOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:PutNotificationConfiguration", "ec2:DescribeInstanceStatus", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sns:Publish" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2017-12-06T22:36:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationReadOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:PutNotificationConfiguration", "ec2:DescribeInstanceStatus", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sns:Publish" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-06-06T21:59:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationReadOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:PutNotificationConfiguration", "ec2:DescribeInstanceStatus", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "lambda:GetFunction", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sns:Publish" ], "Resource": [ "*" ] }, { "Sid": "AllowOperationsOnHealthStreamingLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DeleteLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" } ] } }, "v5": { "createdDate": "2018-04-09T22:06:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationReadOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowOperations", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:PutNotificationConfiguration", "ec2:DescribeInstanceStatus", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sns:Publish" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*:log-stream:*" } ] } } }, "createdDate": "2017-09-13T23:46:37.000Z", "lastUpdatedDate": "2019-06-06T21:59:51.000Z" }, "AWSEC2SpotServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v3": { "createdDate": "2018-06-07T21:00:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringNotEquals": { "ec2:InstanceMarketType": "spot" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } } ] } }, "v1": { "createdDate": "2017-09-18T18:51:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2017-11-15T00:03:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } } ] } }, "v4": { "createdDate": "2018-12-12T00:13:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringNotEquals": { "ec2:InstanceMarketType": "spot" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } } ] } } }, "createdDate": "2017-09-18T18:51:54.000Z", "lastUpdatedDate": "2018-12-12T00:13:51.000Z" }, "AmazonRedshiftServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-09-15T20:44:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-09-25T21:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-11-15T06:41:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] } ] } }, "v5": { "createdDate": "2021-11-22T21:08:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRouteTable", "ec2:AttachInternetGateway", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:AssociateRouteTable", "ec2:RevokeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyVpcAttribute", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:CreateInternetGateway", "ec2:CreateVpc", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-05-25T05:09:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRouteTable", "ec2:AttachInternetGateway", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:AssociateRouteTable", "ec2:RevokeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyVpcAttribute", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:CreateInternetGateway", "ec2:CreateVpc", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless" ] } } } ] } }, "v7": { "createdDate": "2022-06-01T00:34:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRouteTable", "ec2:AttachInternetGateway", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:AssociateRouteTable", "ec2:RevokeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyVpcAttribute", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:CreateInternetGateway", "ec2:CreateVpc", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless" ] } } } ] } }, "v8": { "createdDate": "2022-09-07T20:27:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRouteTable", "ec2:AttachInternetGateway", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:AssociateRouteTable", "ec2:RevokeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyVpcAttribute", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:CreateInternetGateway", "ec2:CreateVpc", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } } ] } }, "v9": { "createdDate": "2023-04-05T20:32:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRouteTable", "ec2:AttachInternetGateway", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:AssociateRouteTable", "ec2:RevokeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyVpcAttribute", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:CreateInternetGateway", "ec2:CreateVpc", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Purpose": "RedshiftMigrateToVpc" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } } ] } }, "v10": { "createdDate": "2023-05-08T18:57:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } } ] } }, "v11": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "redshift", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "redshift", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v13": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Ec2VpcPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Sid": "PublicAccessCreateEip", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "PublicAccessReleaseEip", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Sid": "CreateSecurityGroupWithTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "SecurityGroupPermissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsOnResources", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Sid": "SecretManager", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "redshift", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecretsManagerRandomPassword", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Sid": "IPV6Permissions", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "ServiceQuotasToCheckCustomerLimits", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": [ "arn:aws:servicequotas:*:*:ec2/L-0263D0A3", "arn:aws:servicequotas:*:*:vpc/L-29B6F2EB" ] } ] } }, "v14": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Ec2VpcPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Sid": "PublicAccessCreateEip", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "PublicAccessReleaseEip", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Sid": "CreateSecurityGroupWithTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "SecurityGroupPermissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsOnResources", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Sid": "SecretManager", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "redshift", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecretsManagerRandomPassword", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Sid": "IPV6Permissions", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "ServiceQuotasToCheckCustomerLimits", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": [ "arn:aws:servicequotas:*:*:ec2/L-0263D0A3", "arn:aws:servicequotas:*:*:vpc/L-29B6F2EB" ] }, { "Sid": "DiscoverRedshiftCatalogs", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "Bool": { "glue:EnabledForRedshiftAutoDiscovery": "true" } } } ] } }, "v15": { "createdDate": "2017-09-18T19:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Ec2VpcPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "*" }, { "Sid": "PublicAccessCreateEip", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "PublicAccessReleaseEip", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid": "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Sid": "CreateSecurityGroupWithTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Redshift": "true" } } }, { "Sid": "SecurityGroupPermissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Redshift": "true" } } }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsOnResources", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Sid": "SecretManager", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "redshift", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecretsManagerRandomPassword", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Sid": "IPV6Permissions", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "ServiceQuotasToCheckCustomerLimits", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": [ "arn:aws:servicequotas:*:*:ec2/L-0263D0A3", "arn:aws:servicequotas:*:*:vpc/L-29B6F2EB" ] }, { "Sid": "DiscoverRedshiftCatalogs", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "Bool": { "glue:EnabledForRedshiftAutoDiscovery": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationGetMetadataAccessForFederatedCatalogs", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ], "Condition": { "Bool": { "lakeformation:EnabledOnlyForMetaDataAccess": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "glue.amazonaws.com" } } } ] } } }, "createdDate": "2017-09-18T19:19:45.000Z", "lastUpdatedDate": "2025-02-19T17:22:07.000Z" }, "AWSElasticLoadBalancingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2017-09-19T22:19:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-05-14T21:18:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-10-07T22:55:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-03-18T21:51:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-05-19T16:40:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:GetCoipPoolUsage", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:ReleaseAddress", "ec2:UnassignIpv6Addresses", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "outposts:GetOutpostInstanceTypes" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-08-26T19:01:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:GetCoipPoolUsage", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:ReleaseAddress", "ec2:UnassignIpv6Addresses", "ec2:DescribeVpcPeeringConnections", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "outposts:GetOutpostInstanceTypes" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-05-05T19:32:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:GetCoipPoolUsage", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "outposts:GetOutpostInstanceTypes" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2017-09-19T22:19:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:ReleaseAddress", "ec2:UnassignIpv6Addresses", "ec2:DescribeVpcPeeringConnections", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "outposts:GetOutpostInstanceTypes" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2017-09-19T22:19:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:ReleaseAddress", "ec2:UnassignIpv6Addresses", "ec2:DescribeVpcPeeringConnections", "ec2:AllocateIpamPoolCidr", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "outposts:GetOutpostInstanceTypes" ], "Resource": "*" } ] } } }, "createdDate": "2017-09-19T22:19:04.000Z", "lastUpdatedDate": "2025-02-17T20:22:06.000Z" }, "AWSElasticLoadBalancingClassicServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingClassicServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-09-19T22:36:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T23:04:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcClassicLink", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupIngress", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*" } ] } } }, "createdDate": "2017-09-19T22:36:18.000Z", "lastUpdatedDate": "2019-10-07T23:04:27.000Z" }, "AWSEnhancedClassicNetworkingMangementPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSEnhancedClassicNetworkingMangementPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-09-20T17:29:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeInstances", "ec2:DescribeSecurityGroups" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-09-20T17:29:09.000Z", "lastUpdatedDate": "2017-09-20T17:29:09.000Z" }, "AmazonEMRCleanupPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-09-26T23:54:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSpotInstanceRequests", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:CancelSpotInstanceRequests", "ec2:DeleteNetworkInterface", "ec2:DescribeInstanceAttribute", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "ec2:DeleteVolume" ] } ] } }, "v3": { "createdDate": "2020-09-29T21:11:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeSpotInstanceRequests", "ec2:DeleteLaunchTemplate", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:CancelSpotInstanceRequests", "ec2:DeleteNetworkInterface", "ec2:DescribeInstanceAttribute", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "ec2:DeleteVolume", "ec2:DescribePlacementGroups", "ec2:DeletePlacementGroup" ] } ] } }, "v2": { "createdDate": "2020-06-25T20:40:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeSpotInstanceRequests", "ec2:DeleteLaunchTemplate", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:CancelSpotInstanceRequests", "ec2:DeleteNetworkInterface", "ec2:DescribeInstanceAttribute", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "ec2:DeleteVolume" ] } ] } } }, "createdDate": "2017-09-26T23:54:19.000Z", "lastUpdatedDate": "2020-09-29T21:11:54.000Z" }, "LexChannelPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/LexChannelPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-02-17T23:23:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lex:PostText" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-02-17T23:23:24.000Z", "lastUpdatedDate": "2017-02-17T23:23:24.000Z" }, "LexBotPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/LexBotPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2019-11-13T22:29:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "comprehend:DetectSentiment" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2017-02-17T22:18:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-02-17T22:18:13.000Z", "lastUpdatedDate": "2019-11-13T22:29:16.000Z" }, "AWSLambdaReplicator": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLambdaReplicator", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2017-10-03T23:31:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LambdaCreateDeletePermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "IamPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "CloudFrontListDistributions", "Effect": "Allow", "Action": [ "cloudfront:ListDistributionsByLambdaFunction" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2017-05-23T17:53:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LambdaCreateDeletePermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "IamPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2017-12-08T00:17:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LambdaCreateDeletePermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:DisableReplication" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "IamPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "CloudFrontListDistributions", "Effect": "Allow", "Action": [ "cloudfront:ListDistributionsByLambdaFunction" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-05-23T17:53:03.000Z", "lastUpdatedDate": "2017-12-08T00:17:54.000Z" }, "AWSOrganizationsServiceTrustPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-10-10T23:04:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDeletionOfServiceLinkedRoleForOrganizations", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/organizations.amazonaws.com/*" ] } ] } }, "v2": { "createdDate": "2017-11-01T06:01:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDeletionOfServiceLinkedRoleForOrganizations", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/organizations.amazonaws.com/*" ] }, { "Sid": "AllowCreationOfServiceLinkedRoles", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*" } ] } } }, "createdDate": "2017-10-10T23:04:07.000Z", "lastUpdatedDate": "2017-11-01T06:01:18.000Z" }, "AWSServiceRoleForEC2ScheduledInstances": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForEC2ScheduledInstances", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-10-12T18:31:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:ec2sri:scheduledInstanceId" ] } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2sri:scheduledInstanceId": "*" } } } ] } } }, "createdDate": "2017-10-12T18:31:55.000Z", "lastUpdatedDate": "2017-10-12T18:31:55.000Z" }, "AmazonECSServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2017-10-14T01:18:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-03-01T18:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-03-07T18:29:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-10-18T23:18:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" } ] } }, "v4": { "createdDate": "2018-03-22T01:20:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-06-24T23:16:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" } ] } }, "v7": { "createdDate": "2019-11-21T19:49:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:Describe*" ], "Resource": "*" }, { "Sid": "AutoScalingManagement", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup" ], "Resource": "*", "Condition": { "Null": { "autoscaling:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "AutoScalingPlanManagement", "Effect": "Allow", "Action": [ "autoscaling-plans:CreateScalingPlan", "autoscaling-plans:DeleteScalingPlan", "autoscaling-plans:DescribeScalingPlans" ], "Resource": "*" }, { "Sid": "CWAlarmManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" } ] } }, "v8": { "createdDate": "2021-01-13T20:04:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:Describe*" ], "Resource": "*" }, { "Sid": "AutoScalingManagement", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup" ], "Resource": "*", "Condition": { "Null": { "autoscaling:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "AutoScalingPlanManagement", "Effect": "Allow", "Action": [ "autoscaling-plans:CreateScalingPlan", "autoscaling-plans:DeleteScalingPlan", "autoscaling-plans:DescribeScalingPlans" ], "Resource": "*" }, { "Sid": "CWAlarmManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" }, { "Sid": "ExecuteCommandSessionManagement", "Effect": "Allow", "Action": [ "ssm:DescribeSessions" ], "Resource": "*" }, { "Sid": "ExecuteCommand", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ecs:*:*:task/*", "arn:aws:ssm:*:*:document/AmazonECS-ExecuteInteractiveCommand" ] } ] } }, "v9": { "createdDate": "2022-10-14T18:10:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:Describe*" ], "Resource": "*" }, { "Sid": "AutoScalingManagement", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup" ], "Resource": "*", "Condition": { "Null": { "autoscaling:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "AutoScalingPlanManagement", "Effect": "Allow", "Action": [ "autoscaling-plans:CreateScalingPlan", "autoscaling-plans:DeleteScalingPlan", "autoscaling-plans:DescribeScalingPlans" ], "Resource": "*" }, { "Sid": "CWAlarmManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" }, { "Sid": "ExecuteCommandSessionManagement", "Effect": "Allow", "Action": [ "ssm:DescribeSessions" ], "Resource": "*" }, { "Sid": "ExecuteCommand", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ecs:*:*:task/*", "arn:aws:ssm:*:*:document/AmazonECS-ExecuteInteractiveCommand" ] }, { "Sid": "CloudMapResourceCreation", "Effect": "Allow", "Action": [ "servicediscovery:CreateHttpNamespace", "servicediscovery:CreateService" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonECSManaged" ] } } }, { "Sid": "CloudMapResourceTagging", "Effect": "Allow", "Action": "servicediscovery:TagResource", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AmazonECSManaged": "*" } } }, { "Sid": "CloudMapResourceDeletion", "Effect": "Allow", "Action": [ "servicediscovery:DeleteService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "CloudMapResourceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2017-10-14T01:18:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:Describe*" ], "Resource": "*" }, { "Sid": "AutoScalingManagement", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup" ], "Resource": "*", "Condition": { "Null": { "autoscaling:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "AutoScalingPlanManagement", "Effect": "Allow", "Action": [ "autoscaling-plans:CreateScalingPlan", "autoscaling-plans:DeleteScalingPlan", "autoscaling-plans:DescribeScalingPlans" ], "Resource": "*" }, { "Sid": "CWAlarmManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" }, { "Sid": "ExecuteCommandSessionManagement", "Effect": "Allow", "Action": [ "ssm:DescribeSessions" ], "Resource": "*" }, { "Sid": "ExecuteCommand", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ecs:*:*:task/*", "arn:aws:ssm:*:*:document/AmazonECS-ExecuteInteractiveCommand" ] }, { "Sid": "CloudMapResourceCreation", "Effect": "Allow", "Action": [ "servicediscovery:CreateHttpNamespace", "servicediscovery:CreateService" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonECSManaged" ] } } }, { "Sid": "CloudMapResourceTagging", "Effect": "Allow", "Action": "servicediscovery:TagResource", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AmazonECSManaged": "*" } } }, { "Sid": "CloudMapResourceDeletion", "Effect": "Allow", "Action": [ "servicediscovery:DeleteService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "CloudMapResourceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2017-10-14T01:18:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSTaskManagement", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:Describe*", "ec2:DetachNetworkInterface", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:DeleteHealthCheck", "route53:Get*", "route53:List*", "route53:UpdateHealthCheck", "servicediscovery:DeregisterInstance", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:UpdateInstanceCustomHealthStatus" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:Describe*" ], "Resource": "*" }, { "Sid": "AutoScalingManagement", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup", "autoscaling:PutLifecycleHook", "autoscaling:DeleteLifecycleHook", "autoscaling:CompleteLifecycleAction", "autoscaling:RecordLifecycleActionHeartbeat" ], "Resource": "*", "Condition": { "Null": { "autoscaling:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "AutoScalingPlanManagement", "Effect": "Allow", "Action": [ "autoscaling-plans:CreateScalingPlan", "autoscaling-plans:DeleteScalingPlan", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:DescribeScalingPlanResources" ], "Resource": "*" }, { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/ecs-managed-*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "ecs.amazonaws.com" } } }, { "Sid": "CWAlarmManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ECSTagging", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "CWLogGroupManagement", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*" }, { "Sid": "CWLogStreamManagement", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/ecs/*:log-stream:*" }, { "Sid": "ExecuteCommandSessionManagement", "Effect": "Allow", "Action": [ "ssm:DescribeSessions" ], "Resource": "*" }, { "Sid": "ExecuteCommand", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ecs:*:*:task/*", "arn:aws:ssm:*:*:document/AmazonECS-ExecuteInteractiveCommand" ] }, { "Sid": "CloudMapResourceCreation", "Effect": "Allow", "Action": [ "servicediscovery:CreateHttpNamespace", "servicediscovery:CreateService" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonECSManaged" ] } } }, { "Sid": "CloudMapResourceTagging", "Effect": "Allow", "Action": "servicediscovery:TagResource", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AmazonECSManaged": "*" } } }, { "Sid": "CloudMapResourceDeletion", "Effect": "Allow", "Action": [ "servicediscovery:DeleteService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonECSManaged": "false" } } }, { "Sid": "CloudMapResourceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision" ], "Resource": "*" } ] } } }, "createdDate": "2017-10-14T01:18:58.000Z", "lastUpdatedDate": "2023-12-04T19:32:25.000Z" }, "AWSApplicationAutoscalingRDSClusterPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingRDSClusterPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-10-17T17:46:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CreateDBInstance", "rds:DeleteDBInstance", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2017-12-04T19:13:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CreateDBInstance", "rds:DeleteDBInstance", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:ModifyDBCluster", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-08-07T19:14:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CreateDBInstance", "rds:DeleteDBInstance", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:ModifyDBCluster", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "rds.amazonaws.com" } } } ] } } }, "createdDate": "2017-10-17T17:46:56.000Z", "lastUpdatedDate": "2018-08-07T19:14:24.000Z" }, "APIGatewayServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2017-10-20T17:23:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-01-05T19:09:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2019-05-20T18:22:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" } ] } }, "v5": { "createdDate": "2019-07-25T20:03:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" }, { "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "arn:aws:acm:*:*:certificate/*" } ] } }, "v3": { "createdDate": "2018-08-10T17:57:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-10-22T18:22:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" }, { "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "arn:aws:acm:*:*:certificate/*" } ] } }, "v7": { "createdDate": "2020-01-15T20:18:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" }, { "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "arn:aws:acm:*:*:certificate/*" }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterfacePermission", "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfacePermissions", "ec2:UnassignPrivateIpAddresses", "ec2:DescribeSubnets", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": "servicediscovery:GetNamespace", "Resource": "arn:aws:servicediscovery:*:*:namespace/*" }, { "Effect": "Allow", "Action": "servicediscovery:GetService", "Resource": "arn:aws:servicediscovery:*:*:service/*" } ] } }, "v8": { "createdDate": "2020-02-25T20:24:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" }, { "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "arn:aws:acm:*:*:certificate/*" }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterfacePermission", "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Owner", "VpcLinkId" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfacePermissions", "ec2:UnassignPrivateIpAddresses", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "servicediscovery:GetNamespace", "Resource": "arn:aws:servicediscovery:*:*:namespace/*" }, { "Effect": "Allow", "Action": "servicediscovery:GetService", "Resource": "arn:aws:servicediscovery:*:*:service/*" } ] } }, "v9": { "createdDate": "2021-07-12T22:24:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/amazon-apigateway-*" }, { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:GetCertificate" ], "Resource": "arn:aws:acm:*:*:certificate/*" }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterfacePermission", "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Owner", "VpcLinkId" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfacePermissions", "ec2:UnassignPrivateIpAddresses", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "servicediscovery:GetNamespace", "Resource": "arn:aws:servicediscovery:*:*:namespace/*" }, { "Effect": "Allow", "Action": "servicediscovery:GetService", "Resource": "arn:aws:servicediscovery:*:*:service/*" } ] } } }, "createdDate": "2017-10-20T17:23:10.000Z", "lastUpdatedDate": "2021-07-12T22:24:40.000Z" }, "AWSApplicationAutoscalingAppStreamFleetPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingAppStreamFleetPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-10-20T19:04:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appstream:UpdateFleet", "appstream:DescribeFleets", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-10-20T19:04:06.000Z", "lastUpdatedDate": "2017-10-20T19:04:06.000Z" }, "AWSApplicationAutoscalingDynamoDBTablePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-10-20T21:34:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:UpdateTable", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": "*" } ] } } }, "createdDate": "2017-10-20T21:34:57.000Z", "lastUpdatedDate": "2017-10-20T21:34:57.000Z" }, "AWSEC2SpotFleetServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotFleetServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-10-23T19:13:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:ec2spot:fleet-request-id" ] } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } } ] } }, "v2": { "createdDate": "2017-11-17T22:01:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:ec2spot:fleet-request-id" ] } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } } ] } }, "v3": { "createdDate": "2018-03-28T19:04:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } } ] } }, "v4": { "createdDate": "2020-03-16T19:16:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*", "arn:aws:ec2:*:*:spot-fleet-request/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*/*" ] } ] } } }, "createdDate": "2017-10-23T19:13:06.000Z", "lastUpdatedDate": "2020-03-16T19:16:21.000Z" }, "AWSApplicationAutoscalingEC2SpotFleetRequestPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingEC2SpotFleetRequestPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-10-25T18:23:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSpotFleetRequests", "ec2:ModifySpotFleetRequest", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-10-25T18:23:27.000Z", "lastUpdatedDate": "2017-10-25T18:23:27.000Z" }, "AWSApplicationAutoscalingECSServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-10-25T23:53:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeServices", "ecs:UpdateService", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2017-10-25T23:53:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeServices", "ecs:UpdateService", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-10-25T23:53:08.000Z", "lastUpdatedDate": "2024-10-24T20:05:50.000Z" }, "AWSApplicationAutoscalingEMRInstanceGroupPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingEMRInstanceGroupPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-10-26T00:57:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ModifyInstanceGroups", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-10-26T00:57:39.000Z", "lastUpdatedDate": "2017-10-26T00:57:39.000Z" }, "AmazonChimeReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonChimeReadOnly", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2017-11-01T22:04:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-16T23:00:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ValidateDelegate" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-01-16T17:18:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ValidateDelegate", "chime:ListAccountUsageReportData" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2019-03-18T12:11:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ValidateDelegate", "chime:ListAccountUsageReportData", "chime:GetUserActivityReportData", "chime:GetGlobalSettings", "chime:GetPhoneNumber", "chime:GetPhoneNumberOrder", "chime:GetUserSettings", "chime:GetVoiceConnector", "chime:GetVoiceConnectorOrigination", "chime:GetVoiceConnectorTermination", "chime:GetVoiceConnectorTerminationHealth", "chime:ListPhoneNumberOrders", "chime:ListPhoneNumbers", "chime:ListVoiceConnectorTerminationCredentials", "chime:ListVoiceConnectors", "chime:SearchAvailablePhoneNumbers", "chime:GetTelephonyLimits", "chime:ListCallingRegions" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-03-30T16:24:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ValidateDelegate", "chime:ListAccountUsageReportData", "chime:GetUserActivityReportData" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2019-05-13T20:34:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ValidateDelegate", "chime:ListAccountUsageReportData", "chime:GetUserActivityReportData", "chime:GetGlobalSettings", "chime:GetPhoneNumber", "chime:GetPhoneNumberOrder", "chime:GetUserSettings", "chime:GetVoiceConnector", "chime:GetVoiceConnectorOrigination", "chime:GetVoiceConnectorTermination", "chime:GetVoiceConnectorTerminationHealth", "chime:ListPhoneNumberOrders", "chime:ListPhoneNumbers", "chime:ListVoiceConnectorTerminationCredentials", "chime:ListVoiceConnectors", "chime:SearchAvailablePhoneNumbers", "chime:GetTelephonyLimits", "chime:ListCallingRegions", "chime:GetBot", "chime:ListBots", "chime:GetEventsConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2019-09-10T19:31:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ListAccountUsageReportData", "chime:GetUserActivityReportData", "chime:GetGlobalSettings", "chime:GetPhoneNumber", "chime:GetPhoneNumberOrder", "chime:GetUserSettings", "chime:GetVoiceConnector", "chime:GetVoiceConnectorOrigination", "chime:GetVoiceConnectorTermination", "chime:GetVoiceConnectorTerminationHealth", "chime:ListPhoneNumberOrders", "chime:ListPhoneNumbers", "chime:ListVoiceConnectorTerminationCredentials", "chime:ListVoiceConnectors", "chime:SearchAvailablePhoneNumbers", "chime:GetTelephonyLimits", "chime:ListCallingRegions", "chime:GetBot", "chime:ListBots", "chime:GetEventsConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2019-10-24T16:36:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:ListDomains", "chime:GetDomain", "chime:ListGroups", "chime:ListDirectories", "chime:ListCDRBucket", "chime:GetCDRBucket", "chime:ListDelegates", "chime:GetAccountResource", "chime:ListAccountUsageReportData", "chime:GetUserActivityReportData", "chime:GetGlobalSettings", "chime:GetPhoneNumber", "chime:GetPhoneNumberOrder", "chime:GetPhoneNumberSettings", "chime:GetUserSettings", "chime:GetVoiceConnector", "chime:GetVoiceConnectorOrigination", "chime:GetVoiceConnectorTermination", "chime:GetVoiceConnectorTerminationHealth", "chime:GetVoiceConnectorStreamingConfiguration", "chime:GetVoiceConnectorLoggingConfiguration", "chime:GetVoiceConnectorGroup", "chime:ListPhoneNumberOrders", "chime:ListPhoneNumbers", "chime:ListVoiceConnectorTerminationCredentials", "chime:ListVoiceConnectors", "chime:ListVoiceConnectorGroups", "chime:SearchAvailablePhoneNumbers", "chime:GetTelephonyLimits", "chime:ListCallingRegions", "chime:GetBot", "chime:ListBots", "chime:GetEventsConfiguration" ], "Effect": "Allow", "Resource": "*" } ] } }, "v10": { "createdDate": "2020-12-14T20:53:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:List*", "chime:Get*", "chime:Describe*", "chime:SearchAvailablePhoneNumbers" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2019-11-18T18:49:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:List*", "chime:Get*", "chime:SearchAvailablePhoneNumbers" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-11-01T22:04:17.000Z", "lastUpdatedDate": "2020-12-14T20:53:57.000Z" }, "AmazonChimeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonChimeFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-11-01T22:15:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-19T18:17:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketWebsite" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:DescribeResourcePolicies", "logs:PutResourcePolicy", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:CreateQueue" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] } ] } }, "v3": { "createdDate": "2020-12-14T21:00:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketWebsite" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:DescribeResourcePolicies", "logs:PutResourcePolicy", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:CreateQueue" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Action": [ "kinesis:ListStreams" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:DescribeStream" ], "Resource": [ "arn:aws:kinesis:*:*:stream/chime-chat-*", "arn:aws:kinesis:*:*:stream/chime-messaging-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::chime-chat-*" ] } ] } } }, "createdDate": "2017-11-01T22:15:43.000Z", "lastUpdatedDate": "2020-12-14T21:00:52.000Z" }, "AmazonChimeUserManagement": { "arn": "arn:aws:iam::aws:policy/AmazonChimeUserManagement", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2017-11-01T22:17:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-01-16T17:19:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-03-30T16:25:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-10-29T22:40:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData", "chime:UpdateUser", "chime:BatchUpdateUser" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2018-12-19T21:29:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData", "chime:UpdateUser", "chime:BatchUpdateUser", "chime:BatchSuspendUser", "chime:BatchUnsuspendUser" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2019-03-18T12:17:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData", "chime:UpdateUser", "chime:BatchUpdateUser", "chime:BatchSuspendUser", "chime:BatchUnsuspendUser", "chime:AssociatePhoneNumberWithUser", "chime:DisassociatePhoneNumberFromUser", "chime:GetPhoneNumber", "chime:ListPhoneNumbers", "chime:GetUserSettings", "chime:UpdateUserSettings" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2019-12-10T19:30:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:InviteUsersFromProvider", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData", "chime:UpdateUser", "chime:BatchUpdateUser", "chime:BatchSuspendUser", "chime:BatchUnsuspendUser", "chime:AssociatePhoneNumberWithUser", "chime:DisassociatePhoneNumberFromUser", "chime:GetPhoneNumber", "chime:ListPhoneNumbers", "chime:GetUserSettings", "chime:UpdateUserSettings" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2020-02-18T19:26:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:ListAccounts", "chime:GetAccount", "chime:GetAccountSettings", "chime:UpdateAccountSettings", "chime:ListUsers", "chime:GetUser", "chime:GetUserByEmail", "chime:InviteUsers", "chime:InviteUsersFromProvider", "chime:SuspendUsers", "chime:ActivateUsers", "chime:UpdateUserLicenses", "chime:ResetPersonalPIN", "chime:LogoutUser", "chime:ListDomains", "chime:GetDomain", "chime:ListDirectories", "chime:ListGroups", "chime:SubmitSupportRequest", "chime:ListDelegates", "chime:ListAccountUsageReportData", "chime:GetMeetingDetail", "chime:ListMeetingEvents", "chime:ListMeetingsReportData", "chime:GetUserActivityReportData", "chime:UpdateUser", "chime:BatchUpdateUser", "chime:BatchSuspendUser", "chime:BatchUnsuspendUser", "chime:AssociatePhoneNumberWithUser", "chime:DisassociatePhoneNumberFromUser", "chime:GetPhoneNumber", "chime:ListPhoneNumbers", "chime:GetUserSettings", "chime:UpdateUserSettings", "chime:CreateUser", "chime:AssociateSigninDelegateGroupsWithAccount", "chime:DisassociateSigninDelegateGroupsFromAccount" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-11-01T22:17:26.000Z", "lastUpdatedDate": "2020-02-18T19:26:10.000Z" }, "CloudHSMServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudHSMServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-06T19:12:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*" ] } ] } } }, "createdDate": "2017-11-06T19:12:46.000Z", "lastUpdatedDate": "2017-11-06T19:12:46.000Z" }, "AmazonECS_FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "latestVersionId": "v21", "versionsCount": 21, "versions": { "v1": { "createdDate": "2017-11-07T21:36:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2017-11-10T17:28:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } } ] } }, "v3": { "createdDate": "2017-11-24T17:57:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } } ] } }, "v4": { "createdDate": "2017-12-27T23:30:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2018-01-26T22:57:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2018-03-06T22:34:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2018-04-10T21:19:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2018-07-18T16:04:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2018-07-23T17:54:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2018-07-24T18:13:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2018-11-21T23:34:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetApplications", "codedeploy:ListApplicationRevisions", "codedeploy:ListDeploymentConfigs", "codedpeloy:ContinueDeployment", "sns:ListTopics", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v14": { "createdDate": "2019-01-04T21:11:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetApplications", "codedeploy:ListApplicationRevisions", "codedeploy:ListDeploymentConfigs", "codedeploy:ContinueDeployment", "sns:ListTopics", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2018-11-20T21:51:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v15": { "createdDate": "2019-02-04T18:44:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetApplications", "codedeploy:ListApplicationRevisions", "codedeploy:ListDeploymentConfigs", "codedeploy:ContinueDeployment", "sns:ListTopics", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "servicediscovery:DeleteService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2018-11-21T18:07:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v16": { "createdDate": "2019-06-20T17:53:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:DescribeVirtualNode", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetApplications", "codedeploy:ListApplicationRevisions", "codedeploy:ListDeploymentConfigs", "codedeploy:ContinueDeployment", "sns:ListTopics", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "servicediscovery:DeleteService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v17": { "createdDate": "2020-03-23T19:56:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:DescribeVirtualNode", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetDeployment", "codedeploy:GetDeploymentGroup", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:StopDeployment", "codedeploy:GetDeploymentTarget", "codedeploy:ListDeploymentTargets", "codedeploy:GetDeploymentConfig", "codedeploy:GetApplicationRevision", "codedeploy:RegisterApplicationRevision", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetApplications", "codedeploy:ListApplicationRevisions", "codedeploy:ListDeploymentConfigs", "codedeploy:ContinueDeployment", "sns:ListTopics", "lambda:ListFunctions", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RunInstances", "ec2:RequestSpotFleet", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeAccessPoints", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "ecs:*", "events:DescribeRule", "events:DeleteRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "servicediscovery:DeleteService" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "autoscaling.amazonaws.com" ] } } } ] } }, "v18": { "createdDate": "2020-07-01T15:16:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:ListMeshes", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "autoscaling:UpdateAutoScalingGroup", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:ContinueDeployment", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentGroup", "codedeploy:GetDeploymentTarget", "codedeploy:ListApplicationRevisions", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "codedeploy:RegisterApplicationRevision", "codedeploy:StopDeployment", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "ec2:RunInstances", "ecs:*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHostedZonesByName", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:DeleteService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "ecs.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } } ] } }, "v19": { "createdDate": "2020-10-12T21:02:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:ListMeshes", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "autoscaling:UpdateAutoScalingGroup", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:ContinueDeployment", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentGroup", "codedeploy:GetDeploymentTarget", "codedeploy:ListApplicationRevisions", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "codedeploy:RegisterApplicationRevision", "codedeploy:StopDeployment", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "ec2:RunInstances", "ecs:*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "fsx:DescribeFileSystems", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHostedZonesByName", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:DeleteService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "ecs.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } } ] } }, "v20": { "createdDate": "2023-01-04T16:26:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:ListMeshes", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "autoscaling:UpdateAutoScalingGroup", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:ContinueDeployment", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentGroup", "codedeploy:GetDeploymentTarget", "codedeploy:ListApplicationRevisions", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "codedeploy:RegisterApplicationRevision", "codedeploy:StopDeployment", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "ec2:RunInstances", "ecs:*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "fsx:DescribeFileSystems", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHostedZonesByName", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:DeleteService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "ecs.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags" ], "Resource": "*", "Condition": { "StringEquals": { "elasticloadbalancing:CreateAction": [ "CreateTargetGroup", "CreateRule", "CreateListener", "CreateLoadBalancer" ] } } } ] } }, "v21": { "createdDate": "2017-11-07T21:36:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECSIntegrationsManagementPolicy", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:ListMeshes", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "autoscaling:UpdateAutoScalingGroup", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:ContinueDeployment", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentGroup", "codedeploy:GetDeploymentTarget", "codedeploy:ListApplicationRevisions", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "codedeploy:RegisterApplicationRevision", "codedeploy:StopDeployment", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "ec2:RunInstances", "ecs:*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "fsx:DescribeFileSystems", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHostedZonesByName", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:DeleteService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "SSMPolicy", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*" }, { "Sid": "ManagedCloudformationResourcesCleanupPolicy", "Effect": "Allow", "Action": [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup" ], "Resource": [ "*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*" } } }, { "Sid": "TasksPassRolePolicy", "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": "ecs-tasks.amazonaws.com" } } }, { "Sid": "InfrastructurePassRolePolicy", "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInfrastructureRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ecs.amazonaws.com" } } }, { "Sid": "InstancePassRolePolicy", "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "AutoScalingPassRolePolicy", "Action": "iam:PassRole", "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsAutoscaleRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn" ] } } }, { "Sid": "ServiceLinkedRoleCreationPolicy", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "ecs.amazonaws.com", "autoscaling.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Sid": "ELBTaggingPolicy", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags" ], "Resource": "*", "Condition": { "StringEquals": { "elasticloadbalancing:CreateAction": [ "CreateTargetGroup", "CreateRule", "CreateListener", "CreateLoadBalancer" ] } } } ] } } }, "createdDate": "2017-11-07T21:36:54.000Z", "lastUpdatedDate": "2024-08-13T19:39:37.000Z" }, "DynamoDBReplicationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/DynamoDBReplicationServiceRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2017-11-09T23:55:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-02-05T19:08:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "application-autoscaling:DescribeScalableTargets" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-01-22T22:55:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:UpdateTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2018-07-02T21:48:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2020-07-24T21:40:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:UpdateTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "dynamodb:UpdateTimeToLive", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2020-09-09T18:43:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:UpdateTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "dynamodb:UpdateTimeToLive", "dynamodb:DescribeLimits", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2023-05-10T17:04:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:UpdateTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "dynamodb:UpdateTimeToLive", "dynamodb:DescribeLimits", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies", "account:ListRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2017-11-09T23:55:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBActionsNeededForSteadyStateReplication", "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:UpdateTable", "dynamodb:Scan", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeTimeToLive", "dynamodb:UpdateTimeToLive", "dynamodb:DescribeLimits", "dynamodb:GetResourcePolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DescribeScalingPolicies", "account:ListRegions" ], "Resource": "*" }, { "Sid": "DynamoDBReplicationServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } } ] } } }, "createdDate": "2017-11-09T23:55:34.000Z", "lastUpdatedDate": "2024-01-08T20:10:36.000Z" }, "AmazonSSMServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v2": { "createdDate": "2017-11-15T21:25:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2017-11-13T19:20:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-07-25T22:14:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2019-10-24T23:36:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2020-01-22T21:46:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2020-06-04T18:02:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2020-07-31T19:21:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2020-04-20T21:01:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2020-11-11T19:27:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2020-12-11T17:30:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] } ] } }, "v12": { "createdDate": "2021-03-23T18:12:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource", "ssm:GetCalendarState" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] } ] } }, "v11": { "createdDate": "2021-01-05T23:57:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource", "ssm:GetCalendarState" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] } ] } }, "v13": { "createdDate": "2021-04-26T20:43:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:ListTagsForResource", "ssm:GetCalendarState" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEnrollmentStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations", "config:DescribeConfigurationRecorders" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/SSMExplorerManagedRule" ] }, { "Effect": "Allow", "Action": "events:DescribeRule", "Resource": "*" }, { "Effect": "Allow", "Action": "securityhub:DescribeHub", "Resource": "*" } ] } }, "v14": { "createdDate": "2022-09-14T19:46:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListTagsForResource", "ssm:GetCalendarState" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEnrollmentStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations", "config:DescribeConfigurationRecorders" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "cloudwatch:DescribeAlarms", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/SSMExplorerManagedRule" ] }, { "Effect": "Allow", "Action": "events:DescribeRule", "Resource": "*" }, { "Effect": "Allow", "Action": "securityhub:DescribeHub", "Resource": "*" } ] } }, "v15": { "createdDate": "2017-11-13T19:20:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:ListCommands", "ssm:SendCommand", "ssm:GetAutomationExecution", "ssm:GetParameters", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListTagsForResource", "ssm:GetCalendarState" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SSM*", "arn:aws:lambda:*:*:function:*:SSM*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:StartExecution" ], "Resource": [ "arn:aws:states:*:*:stateMachine:SSM*", "arn:aws:states:*:*:execution:SSM*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:SelectResourceConfig" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEnrollmentStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeCases" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeComplianceByResource", "config:DescribeRemediationConfigurations", "config:DescribeConfigurationRecorders" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "cloudwatch:DescribeAlarms", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": "cloudformation:ListStackSets", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackInstances", "cloudformation:DescribeStackSetOperation", "cloudformation:DeleteStackSet" ], "Resource": "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*" }, { "Effect": "Allow", "Action": "cloudformation:DeleteStackInstances", "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-SSM*:*", "arn:aws:cloudformation:*:*:type/resource/*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/SSMExplorerManagedRule" ] }, { "Effect": "Allow", "Action": "events:DescribeRule", "Resource": "*" }, { "Effect": "Allow", "Action": "securityhub:DescribeHub", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-explorer-2:CreateManagedView", "Resource": "arn:aws:resource-explorer-2:*:*:managed-view/AWSManagedViewForSSM*" } ] } } }, "createdDate": "2017-11-13T19:20:08.000Z", "lastUpdatedDate": "2024-11-15T14:08:27.000Z" }, "AmazonECSTaskExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-16T18:48:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-16T18:48:22.000Z", "lastUpdatedDate": "2017-11-16T18:48:22.000Z" }, "CloudWatchEventsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchEventsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-17T00:42:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:RebootInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:CreateSnapshot" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-17T00:42:04.000Z", "lastUpdatedDate": "2017-11-17T00:42:04.000Z" }, "AmazonInspectorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2018-01-08T17:30:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpn", "ec2:DescribeVpnGateways", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2017-11-21T15:48:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-02-05T18:29:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-09-11T17:12:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "directconnect:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:GetTransitGatewayRouteTablePropagations", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-05-10T18:36:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "directconnect:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-21T15:48:27.000Z", "lastUpdatedDate": "2020-09-11T17:12:02.000Z" }, "AWSPriceListServiceFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPriceListServiceFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-11-22T00:36:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "pricing:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-11-22T00:36:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSPriceListServiceFullAccess", "Effect": "Allow", "Action": [ "pricing:*" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-22T00:36:27.000Z", "lastUpdatedDate": "2024-07-02T13:34:19.000Z" }, "AWSCodeDeployRoleForLambda": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2017-12-01T22:32:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarms", "lambda:UpdateAlias", "lambda:GetAlias", "sns:Publish" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" } ] } }, "v1": { "createdDate": "2017-11-28T14:05:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarms", "lambda:UpdateAlias", "lambda:GetAlias", "sns:Publish" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:region:*:function:CodeDeployHook_*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2019-12-03T19:53:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarms", "lambda:UpdateAlias", "lambda:GetAlias", "lambda:GetProvisionedConcurrencyConfig", "sns:Publish" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" } ] } } }, "createdDate": "2017-11-28T14:05:44.000Z", "lastUpdatedDate": "2019-12-03T19:53:10.000Z" }, "AmazonMQFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMQFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2018-01-11T19:39:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mq:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2017-11-28T15:28:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mq:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-07-31T16:28:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mq:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] } ] } }, "v4": { "createdDate": "2018-12-18T20:33:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mq:*", "cloudformation:CreateStack", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] } ] } }, "v5": { "createdDate": "2020-11-04T16:34:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mq:*", "cloudformation:CreateStack", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "mq.amazonaws.com" } } } ] } } }, "createdDate": "2017-11-28T15:28:29.000Z", "lastUpdatedDate": "2020-11-04T16:34:09.000Z" }, "AmazonMQReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMQReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2017-11-28T19:02:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mq:Describe*", "mq:List*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2017-11-28T15:30:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mq:Describe*", "mq:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-11-28T15:30:32.000Z", "lastUpdatedDate": "2017-11-28T19:02:03.000Z" }, "AmazonGuardDutyServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2017-11-28T20:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-05-14T20:25:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-04-20T16:01:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "organizations:ListAccounts", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-08-03T23:14:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-02-21T16:56:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2023-03-08T19:59:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } } ] } }, "v7": { "createdDate": "2017-11-28T20:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GuardDutyGetDescribeListPolicy", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSecurityGroups", "ecs:ListClusters", "ecs:DescribeClusters" ], "Resource": "*" }, { "Sid": "GuardDutyCreateSLRPolicy", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Sid": "GuardDutyCreateVpcEndpointPolicy", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Sid": "GuardDutyModifyDeleteVpcEndpointPolicy", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateModifyVpcEndpointNetworkPolicy", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "GuardDutyCreateTagsDuringVpcEndpointCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutySecurityGroupManagementPolicy", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateSecurityGroupPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Sid": "GuardDutyCreateSecurityGroupForVpcPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "GuardDutyCreateTagsDuringSecurityGroupCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyCreateEksAddonPolicy", "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEksAddonManagementPolicy", "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Sid": "GuardDutyEksClusterTagResourcePolicy", "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEcsPutAccountSettingsDefaultPolicy", "Effect": "Allow", "Action": "ecs:PutAccountSettingDefault", "Resource": "*", "Condition": { "StringEquals": { "ecs:account-setting": [ "guardDutyActivate" ] } } } ] } }, "v8": { "createdDate": "2017-11-28T20:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GuardDutyGetDescribeListPolicy", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSecurityGroups", "ecs:ListClusters", "ecs:DescribeClusters" ], "Resource": "*" }, { "Sid": "GuardDutyCreateSLRPolicy", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Sid": "GuardDutyCreateVpcEndpointPolicy", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Sid": "GuardDutyModifyDeleteVpcEndpointPolicy", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateModifyVpcEndpointNetworkPolicy", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "GuardDutyCreateTagsDuringVpcEndpointCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutySecurityGroupManagementPolicy", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateSecurityGroupPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Sid": "GuardDutyCreateSecurityGroupForVpcPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "GuardDutyCreateTagsDuringSecurityGroupCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyCreateEksAddonPolicy", "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEksAddonManagementPolicy", "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Sid": "GuardDutyEksClusterTagResourcePolicy", "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEcsPutAccountSettingsDefaultPolicy", "Effect": "Allow", "Action": "ecs:PutAccountSettingDefault", "Resource": "*", "Condition": { "StringEquals": { "ecs:account-setting": [ "guardDutyActivate" ] } } } ] } }, "v9": { "createdDate": "2017-11-28T20:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GuardDutyGetDescribeListPolicy", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSecurityGroups", "ecs:ListClusters", "ecs:DescribeClusters" ], "Resource": "*" }, { "Sid": "GuardDutyCreateSLRPolicy", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Sid": "GuardDutyCreateVpcEndpointPolicy", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Sid": "GuardDutyModifyDeleteVpcEndpointPolicy", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateModifyVpcEndpointNetworkPolicy", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "GuardDutyCreateTagsDuringVpcEndpointCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutySecurityGroupManagementPolicy", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateSecurityGroupPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Sid": "GuardDutyCreateSecurityGroupForVpcPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "GuardDutyCreateTagsDuringSecurityGroupCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyCreateEksAddonPolicy", "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEksAddonManagementPolicy", "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Sid": "GuardDutyEksClusterTagResourcePolicy", "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEcsPutAccountSettingsDefaultPolicy", "Effect": "Allow", "Action": "ecs:PutAccountSettingDefault", "Resource": "*", "Condition": { "StringEquals": { "ecs:account-setting": [ "guardDutyActivate" ] } } }, { "Sid": "SsmCreateDescribeUpdateDeleteStartAssociationPermission", "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:DeleteAssociation", "ssm:UpdateAssociation", "ssm:CreateAssociation", "ssm:StartAssociationsOnce" ], "Resource": "arn:aws:ssm:*:*:association/*", "Condition": { "StringEquals": { "aws:ResourceTag/GuardDutyManaged": "true" } } }, { "Sid": "SsmAddTagsToResourcePermission", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:association/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "GuardDutyManaged" ] }, "StringEquals": { "aws:ResourceTag/GuardDutyManaged": "true" } } }, { "Sid": "SsmCreateUpdateAssociationInstanceDocumentPermission", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation" ], "Resource": "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" }, { "Sid": "SsmSendCommandPermission", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" ] }, { "Sid": "SsmGetCommandStatus", "Effect": "Allow", "Action": "ssm:GetCommandInvocation", "Resource": "*" } ] } }, "v10": { "createdDate": "2017-11-28T20:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GuardDutyGetDescribeListPolicy", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ecs:ListClusters", "ecs:DescribeClusters" ], "Resource": "*" }, { "Sid": "GuardDutyCreateSLRPolicy", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Sid": "GuardDutyCreateVpcEndpointPolicy", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Sid": "GuardDutyModifyDeleteVpcEndpointPolicy", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateModifyVpcEndpointNetworkPolicy", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "GuardDutyCreateTagsDuringVpcEndpointCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutySecurityGroupManagementPolicy", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Sid": "GuardDutyCreateSecurityGroupPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Sid": "GuardDutyCreateSecurityGroupForVpcPolicy", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "GuardDutyCreateTagsDuringSecurityGroupCreationPolicy", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyCreateEksAddonPolicy", "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEksAddonManagementPolicy", "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Sid": "GuardDutyEksClusterTagResourcePolicy", "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Sid": "GuardDutyEcsPutAccountSettingsDefaultPolicy", "Effect": "Allow", "Action": "ecs:PutAccountSettingDefault", "Resource": "*", "Condition": { "StringEquals": { "ecs:account-setting": [ "guardDutyActivate" ] } } }, { "Sid": "SsmCreateDescribeUpdateDeleteStartAssociationPermission", "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:DeleteAssociation", "ssm:UpdateAssociation", "ssm:CreateAssociation", "ssm:StartAssociationsOnce" ], "Resource": "arn:aws:ssm:*:*:association/*", "Condition": { "StringEquals": { "aws:ResourceTag/GuardDutyManaged": "true" } } }, { "Sid": "SsmAddTagsToResourcePermission", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:association/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "GuardDutyManaged" ] }, "StringEquals": { "aws:ResourceTag/GuardDutyManaged": "true" } } }, { "Sid": "SsmCreateUpdateAssociationInstanceDocumentPermission", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation" ], "Resource": "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" }, { "Sid": "SsmSendCommandPermission", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" ] }, { "Sid": "SsmGetCommandStatus", "Effect": "Allow", "Action": "ssm:GetCommandInvocation", "Resource": "*" } ] } } }, "createdDate": "2017-11-28T20:12:59.000Z", "lastUpdatedDate": "2024-08-12T20:01:11.000Z" }, "AmazonGuardDutyReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-11-28T22:29:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllUsersToViewAndManageThisGroup", "Effect": "Allow", "Action": [ "guardduty:GetDetector", "guardduty:ListDetectors", "guardduty:GetIPSet", "guardduty:ListIPSets", "guardduty:GetThreatIntelSet", "guardduty:ListThreatIntelSets", "guardduty:GetFindings", "guardduty:GetFindingsStatistics", "guardduty:ListFindings", "guardduty:GetMembers", "guardduty:ListMembers", "guardduty:GetMasterAccount", "guardduty:ListInvitations", "guardduty:GetInvitationsCount" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-02-16T23:37:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "guardduty:Describe*", "guardduty:Get*", "guardduty:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-04-25T21:07:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "guardduty:Get*", "guardduty:List*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-11-28T22:29:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "guardduty:Describe*", "guardduty:Get*", "guardduty:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-28T22:29:40.000Z", "lastUpdatedDate": "2023-11-16T23:07:06.000Z" }, "AmazonGuardDutyFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonGuardDutyFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2017-11-28T22:31:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "guardduty.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-07-19T20:36:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "guardduty.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*guardduty.amazonaws.com/*" } ] } }, "v2": { "createdDate": "2021-02-16T23:39:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "guardduty.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-07-26T18:28:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "guardduty.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*AWSServiceRoleForAmazonGuardDutyMalwareProtection" } ] } }, "v5": { "createdDate": "2017-11-28T22:31:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonGuardDutyFullAccessSid1", "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Sid": "CreateServiceLinkedRoleSid1", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "guardduty.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ] } } }, { "Sid": "ActionsForOrganizationsSid1", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Sid": "IamGetRoleSid1", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*AWSServiceRoleForAmazonGuardDutyMalwareProtection" } ] } }, "v6": { "createdDate": "2017-11-28T22:31:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonGuardDutyFullAccessSid1", "Effect": "Allow", "Action": "guardduty:*", "Resource": "*" }, { "Sid": "CreateServiceLinkedRoleSid1", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "guardduty.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ] } } }, { "Sid": "ActionsForOrganizationsSid1", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Sid": "IamGetRoleSid1", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*AWSServiceRoleForAmazonGuardDutyMalwareProtection" }, { "Sid": "AllowPassRoleToMalwareProtectionPlan", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "malware-protection-plan.guardduty.amazonaws.com" } } } ] } } }, "createdDate": "2017-11-28T22:31:30.000Z", "lastUpdatedDate": "2024-06-10T22:50:31.000Z" }, "AmazonSageMakerReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerReadOnly", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v2": { "createdDate": "2018-02-23T00:39:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListNotebookInstances", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-06-07T19:03:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2017-11-29T13:07:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListNotebookInstances" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-11-28T16:23:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2019-01-04T22:22:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-06-10T20:38:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*", "sagemaker:Describe*", "sagemaker:GetSearchSuggestions", "sagemaker:List*", "sagemaker:Search" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-12-03T16:40:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "sagemaker:BatchGetMetrics", "sagemaker:GetSearchSuggestions", "sagemaker:Search" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-12-08T16:17:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "sagemaker:BatchGetMetrics", "sagemaker:GetDeviceRegistration", "sagemaker:GetDeviceFleetReport", "sagemaker:GetSearchSuggestions", "sagemaker:GetRecord", "sagemaker:Search" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-12-01T16:17:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "sagemaker:BatchGetMetrics", "sagemaker:GetSearchSuggestions", "sagemaker:GetRecord", "sagemaker:Search" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2021-06-10T20:19:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "sagemaker:BatchGetMetrics", "sagemaker:GetDeviceRegistration", "sagemaker:GetDeviceFleetReport", "sagemaker:GetSearchSuggestions", "sagemaker:GetRecord", "sagemaker:Search", "sagemaker:BatchGetRecord" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2021-12-01T16:29:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:Describe*", "sagemaker:List*", "sagemaker:BatchGetMetrics", "sagemaker:GetDeviceRegistration", "sagemaker:GetDeviceFleetReport", "sagemaker:GetSearchSuggestions", "sagemaker:BatchGetRecord", "sagemaker:GetRecord", "sagemaker:Search", "sagemaker:QueryLineage", "sagemaker:GetLineageGroupPolicy", "sagemaker:BatchDescribeModelPackage", "sagemaker:GetModelPackageGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "aws-marketplace:ViewSubscriptions", "cloudwatch:DescribeAlarms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "ecr:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T13:07:09.000Z", "lastUpdatedDate": "2021-12-01T16:29:20.000Z" }, "AmazonSageMakerFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess", "latestVersionId": "v27", "versionsCount": 27, "versions": { "v2": { "createdDate": "2018-01-08T22:18:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2017-11-29T13:07:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-02-23T00:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SagemakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2018-02-28T18:31:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2018-08-21T17:00:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2018-04-24T23:12:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2019-01-04T22:07:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:Describe*", "elastic-inference:Connect", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2018-11-13T19:16:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "iam:ListRoles", "iam:ListRoles", "kms:DescribeKey", "kms:DescribeKey", "kms:ListAliases", "kms:ListAliases", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] } }, "v11": { "createdDate": "2019-05-09T04:44:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:Describe*", "elastic-inference:Connect", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2019-08-21T22:56:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2018-11-28T16:16:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2019-10-25T21:00:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:DescribeResourcePolicies", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2019-05-06T23:20:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:Describe*", "elastic-inference:Connect", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v15": { "createdDate": "2019-12-03T16:32:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:*FlowDefinition", "sagemaker:*FlowDefinitions" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } } ] } }, "v14": { "createdDate": "2019-10-29T22:22:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:ListBranches", "codecommit:ListRepositories", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListUsersInGroup", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:DescribeResourcePolicies", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } } ] } }, "v16": { "createdDate": "2020-01-13T20:47:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } } ] } }, "v20": { "createdDate": "2021-07-16T00:06:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] } ] } }, "v19": { "createdDate": "2021-02-24T01:19:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] } ] } }, "v21": { "createdDate": "2021-09-08T17:12:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] } ] } }, "v17": { "createdDate": "2020-06-03T17:26:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob", "glue:GetJobRun", "glue:GetJobRuns", "glue:GetJobs", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/*sagemaker*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } } ] } }, "v18": { "createdDate": "2020-12-01T16:31:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] } ] } }, "v22": { "createdDate": "2022-05-02T06:19:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" } ] } }, "v23": { "createdDate": "2022-06-29T18:30:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" } ] } }, "v24": { "createdDate": "2022-11-30T17:14:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:DescribeSpace", "sagemaker:ListSpaces", "sagemaker:*App", "sagemaker:ListApps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore" ] }, { "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" } ] } }, "v25": { "createdDate": "2017-11-29T13:07:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowAddTagsForApp", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*" ] }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:DescribeSpace", "sagemaker:ListSpaces", "sagemaker:DescribeApp", "sagemaker:ListApps" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowReadOnlySecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Sid": "AllowS3BucketACL", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowCreateServiceLinkedRoleForRobomaker", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Sid": "AllowPassRoleToSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateTable", "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueUpdateTable", "Effect": "Allow", "Action": [ "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore" ] }, { "Sid": "AllowGlueDeleteTable", "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetTablesAndDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetAndCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Sid": "AllowRedshiftDataActions", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTagsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowS3ExpressObjectActions", "Effect": "Allow", "Action": [ "s3express:CreateSession" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*", "arn:aws:s3express:*:*:bucket/*aws-glue*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressCreateBucketActions", "Effect": "Allow", "Action": [ "s3express:CreateBucket" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressListBucketActions", "Effect": "Allow", "Action": [ "s3express:ListAllMyDirectoryBuckets" ], "Resource": "*" } ] } }, "v26": { "createdDate": "2017-11-29T13:07:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowAddTagsForSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": "CreateSpace" } } }, { "Sid": "AllowAddTagsForApp", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*" ] }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:DescribeSpace", "sagemaker:ListSpaces", "sagemaker:DescribeApp", "sagemaker:ListApps" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowReadOnlySecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Sid": "AllowS3BucketACL", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowCreateServiceLinkedRoleForRobomaker", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Sid": "AllowPassRoleToSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateTable", "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueUpdateTable", "Effect": "Allow", "Action": [ "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore" ] }, { "Sid": "AllowGlueDeleteTable", "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetTablesAndDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetAndCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Sid": "AllowRedshiftDataActions", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTagsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowS3ExpressObjectActions", "Effect": "Allow", "Action": [ "s3express:CreateSession" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*", "arn:aws:s3express:*:*:bucket/*aws-glue*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressCreateBucketActions", "Effect": "Allow", "Action": [ "s3express:CreateBucket" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressListBucketActions", "Effect": "Allow", "Action": [ "s3express:ListAllMyDirectoryBuckets" ], "Resource": "*" } ] } }, "v27": { "createdDate": "2017-11-29T13:07:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:partner-app/*", "arn:aws:sagemaker:*:*:flow-definition/*", "arn:aws:sagemaker:*:*:training-plan/*", "arn:aws:sagemaker:*:*:reserved-capacity/*" ] }, { "Sid": "AllowAddTagsForSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": "CreateSpace" } } }, { "Sid": "AllowAddTagsForApp", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*" ] }, { "Sid": "AllowUseOfTrainingPlanResources", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateCluster", "sagemaker:UpdateCluster", "sagemaker:DescribeTrainingPlan" ], "Resource": [ "arn:aws:sagemaker:*:*:training-plan/*", "arn:aws:sagemaker:*:*:reserved-capacity/*" ] }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeDomain", "sagemaker:ListDomains", "sagemaker:DescribeUserProfile", "sagemaker:ListUserProfiles", "sagemaker:DescribeSpace", "sagemaker:ListSpaces", "sagemaker:DescribeApp", "sagemaker:ListApps" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminDisableUser", "cognito-idp:AdminEnableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:CreateGroup", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:CreateUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:List*", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateVpcEndpoint", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "glue:CreateJob", "glue:DeleteJob", "glue:GetJob*", "glue:GetTable*", "glue:GetWorkflowRun", "glue:ResetJobBookmark", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:UpdateJob", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*sagemaker*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowReadOnlySecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*", "arn:aws:s3:::*aws-glue*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": "*" }, { "Sid": "AllowS3BucketACL", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowCreateServiceLinkedRoleForRobomaker", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "robomaker.amazonaws.com", "states.amazonaws.com" ] } } }, { "Sid": "AllowPassRoleToSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListDatabases", "athena:ListTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateTable", "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueUpdateTable", "Effect": "Allow", "Action": [ "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/sagemaker_featurestore/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore" ] }, { "Sid": "AllowGlueDeleteTable", "Effect": "Allow", "Action": [ "glue:DeleteTable" ], "Resource": [ "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetTablesAndDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "AllowGlueGetAndCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:database/sagemaker_processing", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/sagemaker_data_wrangler" ] }, { "Sid": "AllowRedshiftDataActions", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": [ "*" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTagsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowS3ExpressObjectActions", "Effect": "Allow", "Action": [ "s3express:CreateSession" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*", "arn:aws:s3express:*:*:bucket/*aws-glue*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressCreateBucketActions", "Effect": "Allow", "Action": [ "s3express:CreateBucket" ], "Resource": [ "arn:aws:s3express:*:*:bucket/*SageMaker*", "arn:aws:s3express:*:*:bucket/*Sagemaker*", "arn:aws:s3express:*:*:bucket/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowS3ExpressListBucketActions", "Effect": "Allow", "Action": [ "s3express:ListAllMyDirectoryBuckets" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T13:07:59.000Z", "lastUpdatedDate": "2024-12-04T13:21:06.000Z" }, "AmazonFreeRTOSFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonFreeRTOSFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-29T15:32:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "freertos:*" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T15:32:51.000Z", "lastUpdatedDate": "2017-11-29T15:32:51.000Z" }, "AWSDeepLensServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSDeepLensServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2017-11-29T15:46:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*/*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensSageMakerAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens_*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-05-11T21:00:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*/*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensSageMakerAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-02-09T01:32:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*/*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensSageMakerAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2018-05-29T22:09:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition", "greengrass:UpdateResourceDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensLambdaUsersFunctionAccess", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "DeepLensSageMakerWriteAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens*" ] }, { "Sid": "DeepLensSageMakerReadAccess", "Effect": "Allow", "Action": [ "sagemaker:DescribeTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2018-06-07T21:25:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*", "arn:aws:iam::*:role/service-role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition", "greengrass:UpdateResourceDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensLambdaUsersFunctionAccess", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "DeepLensSageMakerWriteAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens*" ] }, { "Sid": "DeepLensSageMakerReadAccess", "Effect": "Allow", "Action": [ "sagemaker:DescribeTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-09-25T19:25:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreatePolicyVersion" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIoTAttachCertificatePolicyAccess", "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/deeplens*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "DeepLensIoTDataAccess", "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/deeplens*" ] }, { "Sid": "DeepLensIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensS3Buckets", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensCreateS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "*" ] }, { "Sid": "DeepLensIAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "DeepLensIAMLambdaPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepLens*", "arn:aws:iam::*:role/service-role/AWSDeepLens*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "DeepLensGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition", "greengrass:UpdateResourceDefinition" ], "Resource": [ "*" ] }, { "Sid": "DeepLensLambdaAdminFunctionAccess", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:deeplens*" ] }, { "Sid": "DeepLensLambdaUsersFunctionAccess", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "DeepLensSageMakerWriteAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/deeplens*" ] }, { "Sid": "DeepLensSageMakerReadAccess", "Effect": "Allow", "Action": [ "sagemaker:DescribeTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] }, { "Sid": "DeepLensKinesisVideoStreamAccess", "Effect": "Allow", "Action": [ "kinesisvideo:CreateStream", "kinesisvideo:DescribeStream", "kinesisvideo:DeleteStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensKinesisVideoEndpointAccess", "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-11-29T15:46:36.000Z", "lastUpdatedDate": "2019-09-25T19:25:06.000Z" }, "AWSDeepLensLambdaFunctionAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AWSDeepLensLambdaFunctionAccessPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-11-29T15:47:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:ListObjects" ], "Resource": [ "arn:aws:s3:::deeplens*/*", "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream", "acuity:PutMedia" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-03-29T19:36:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:ListObjects" ], "Resource": [ "arn:aws:s3:::deeplens*/*", "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensGreenGrassCloudWatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/greengrass/*" }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensAcuityStreamAccess", "Effect": "Allow", "Action": [ "acuity:CreateStream", "acuity:DescribeStream", "acuity:DeleteStream", "acuity:PutMedia" ], "Resource": [ "arn:aws:acuity:*:*:stream/deeplens*/*" ] }, { "Sid": "DeepLensAcuityEndpointAccess", "Effect": "Allow", "Action": [ "acuity:GetDataEndpoint" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-05-29T22:08:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:ListObjects" ], "Resource": [ "arn:aws:s3:::deeplens*/*", "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensGreenGrassCloudWatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/greengrass/*" }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensKinesisVideoAccess", "Effect": "Allow", "Action": [ "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2019-06-11T23:11:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepLensS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::deeplens*/*", "arn:aws:s3:::deeplens*" ] }, { "Sid": "DeepLensGreenGrassCloudWatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/greengrass/*" }, { "Sid": "DeepLensAccess", "Effect": "Allow", "Action": [ "deeplens:*" ], "Resource": [ "*" ] }, { "Sid": "DeepLensKinesisVideoAccess", "Effect": "Allow", "Action": [ "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-11-29T15:47:18.000Z", "lastUpdatedDate": "2019-06-11T23:11:55.000Z" }, "AmazonRekognitionServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonRekognitionServiceRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-29T16:52:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:AmazonRekognition*" }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords" ], "Resource": "arn:aws:kinesis:*:*:stream/AmazonRekognition*" }, { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:GetMedia" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T16:52:13.000Z", "lastUpdatedDate": "2017-11-29T16:52:13.000Z" }, "AWSQuickSightIoTAnalyticsAccess": { "arn": "arn:aws:iam::aws:policy/AWSQuickSightIoTAnalyticsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-29T17:00:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iotanalytics:ListDatasets", "iotanalytics:DescribeDataset", "iotanalytics:GetDatasetContent" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-11-29T17:00:54.000Z", "lastUpdatedDate": "2017-11-29T17:00:54.000Z" }, "ComprehendFullAccess": { "arn": "arn:aws:iam::aws:policy/ComprehendFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-11-29T18:08:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:*", "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2017-12-05T01:36:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2017-11-29T18:08:43.000Z", "lastUpdatedDate": "2017-12-05T01:36:24.000Z" }, "ComprehendReadOnly": { "arn": "arn:aws:iam::aws:policy/ComprehendReadOnly", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2017-11-29T18:10:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-06-27T18:38:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-07-17T22:01:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-11-16T00:44:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2018-11-20T01:54:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2019-11-25T19:35:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2020-09-17T19:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectPiiEntities", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribePiiEntitiesDetectionJob", "comprehend:ListPiiEntitiesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints" ], "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2021-03-26T21:19:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectPiiEntities", "comprehend:ContainsPiiEntities", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribePiiEntitiesDetectionJob", "comprehend:ListPiiEntitiesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-09-28T19:07:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectPiiEntities", "comprehend:ContainsPiiEntities", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribePiiEntitiesDetectionJob", "comprehend:ListPiiEntitiesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints", "comprehend:ListDocumentClassifierSummaries", "comprehend:ListEntityRecognizerSummaries" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2022-02-02T21:08:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectPiiEntities", "comprehend:ContainsPiiEntities", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribePiiEntitiesDetectionJob", "comprehend:ListPiiEntitiesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints", "comprehend:ListDocumentClassifierSummaries", "comprehend:ListEntityRecognizerSummaries", "comprehend:DescribeResourcePolicy" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2022-04-26T21:32:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "comprehend:DetectDominantLanguage", "comprehend:BatchDetectDominantLanguage", "comprehend:DetectEntities", "comprehend:BatchDetectEntities", "comprehend:DetectKeyPhrases", "comprehend:BatchDetectKeyPhrases", "comprehend:DetectPiiEntities", "comprehend:ContainsPiiEntities", "comprehend:DetectSentiment", "comprehend:BatchDetectSentiment", "comprehend:DetectSyntax", "comprehend:BatchDetectSyntax", "comprehend:ClassifyDocument", "comprehend:DescribeTopicsDetectionJob", "comprehend:ListTopicsDetectionJobs", "comprehend:DescribeDominantLanguageDetectionJob", "comprehend:ListDominantLanguageDetectionJobs", "comprehend:DescribeEntitiesDetectionJob", "comprehend:ListEntitiesDetectionJobs", "comprehend:DescribeKeyPhrasesDetectionJob", "comprehend:ListKeyPhrasesDetectionJobs", "comprehend:DescribePiiEntitiesDetectionJob", "comprehend:ListPiiEntitiesDetectionJobs", "comprehend:DescribeSentimentDetectionJob", "comprehend:DescribeTargetedSentimentDetectionJob", "comprehend:ListSentimentDetectionJobs", "comprehend:ListTargetedSentimentDetectionJobs", "comprehend:DescribeDocumentClassifier", "comprehend:ListDocumentClassifiers", "comprehend:DescribeDocumentClassificationJob", "comprehend:ListDocumentClassificationJobs", "comprehend:DescribeEntityRecognizer", "comprehend:ListEntityRecognizers", "comprehend:ListTagsForResource", "comprehend:DescribeEndpoint", "comprehend:ListEndpoints", "comprehend:ListDocumentClassifierSummaries", "comprehend:ListEntityRecognizerSummaries", "comprehend:DescribeResourcePolicy" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T18:10:19.000Z", "lastUpdatedDate": "2022-04-26T21:32:41.000Z" }, "GreengrassOTAUpdateArtifactAccess": { "arn": "arn:aws:iam::aws:policy/service-role/GreengrassOTAUpdateArtifactAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-11-29T18:11:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowsIotToAccessGreengrassOTAUpdateArtifacts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::eu-central-1-greengrass-updates/*", "arn:aws:s3:::us-east-1-greengrass-updates/*", "arn:aws:s3:::ap-northeast-1-greengrass-updates/*", "arn:aws:s3:::us-west-2-greengrass-updates/*", "arn:aws:s3:::ap-southeast-2-greengrass-updates/*" ] } ] } }, "v2": { "createdDate": "2018-12-18T00:59:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowsIotToAccessGreengrassOTAUpdateArtifacts", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*-greengrass-updates/*" ] } ] } } }, "createdDate": "2017-11-29T18:11:47.000Z", "lastUpdatedDate": "2018-12-18T00:59:43.000Z" }, "TranslateReadOnly": { "arn": "arn:aws:iam::aws:policy/TranslateReadOnly", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2017-11-29T18:22:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-04-03T23:03:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-10-22T16:00:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-11-27T23:29:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText", "translate:GetTerminology", "translate:ListTerminologies", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-01-08T21:13:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText", "translate:GetTerminology", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "translate:DescribeTextTranslationJob", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2020-11-23T17:31:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:TranslateText", "translate:GetTerminology", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:ListParallelData", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2023-05-24T17:19:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "translate:TranslateText", "translate:TranslateDocument", "translate:GetTerminology", "translate:ListTerminologies", "translate:ListTextTranslationJobs", "translate:DescribeTextTranslationJob", "translate:GetParallelData", "translate:ListParallelData", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-29T18:22:00.000Z", "lastUpdatedDate": "2023-05-24T17:19:30.000Z" }, "AWSCloud9ServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSCloud9ServiceRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2017-11-30T13:44:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStacksEvents", "cloudformation:DescribeStacksResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } } ] } }, "v2": { "createdDate": "2018-02-27T10:20:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } } ] } }, "v3": { "createdDate": "2020-01-08T12:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } } ] } }, "v4": { "createdDate": "2020-03-16T10:20:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } } ] } }, "v5": { "createdDate": "2020-05-07T09:15:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-StartSSHSession" ] }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": [ "aws-cloud9-*" ] } } }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles" ], "Resource": [ "arn:aws:iam::*:instance-profile/cloud9/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSCloud9SSMAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2020-07-02T17:06:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-StartSSHSession" ] }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/aws:cloudformation:stack-name": [ "aws-cloud9-*" ] } } }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles" ], "Resource": [ "arn:aws:iam::*:instance-profile/cloud9/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2020-10-06T12:43:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/cloud9/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2022-01-17T14:06:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "cloudformation:CreateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-cloud9-*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-name": "aws-cloud9-*" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:license-manager:*:*:license-configuration:*" ] }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/cloud9/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } } }, "createdDate": "2017-11-30T13:44:08.000Z", "lastUpdatedDate": "2022-01-17T14:06:15.000Z" }, "AWSCloud9User": { "arn": "arn:aws:iam::aws:policy/AWSCloud9User", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2017-11-30T16:16:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironment*", "cloud9:ValidateEnvironmentName", "cloud9:GetUserPublicKey", "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-07-02T08:46:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:ValidateEnvironmentName", "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH" ], "Resource": "*", "Condition": { "Null": { "cloud9:OwnerArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:GetUserPublicKey" ], "Resource": "*", "Condition": { "Null": { "cloud9:UserArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-04-26T21:16:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH", "cloud9:ValidateEnvironmentName", "cloud9:GetUserPublicKey", "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-07-29T06:26:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:ValidateEnvironmentName", "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH" ], "Resource": "*", "Condition": { "Null": { "cloud9:OwnerArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:GetUserPublicKey" ], "Resource": "*", "Condition": { "Null": { "cloud9:UserArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v5": { "createdDate": "2023-08-02T08:53:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:ValidateEnvironmentName", "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH" ], "Resource": "*", "Condition": { "Null": { "cloud9:OwnerArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:GetUserPublicKey" ], "Resource": "*", "Condition": { "Null": { "cloud9:UserArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v6": { "createdDate": "2017-11-30T16:16:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH" ], "Resource": "*", "Condition": { "Null": { "cloud9:OwnerArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:GetUserPublicKey" ], "Resource": "*", "Condition": { "Null": { "cloud9:UserArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:GetConnectionStatus" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v7": { "createdDate": "2017-11-30T16:16:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:UpdateUserSettings", "cloud9:GetUserSettings", "cloud9:GetMigrationExperiences", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:CreateEnvironmentEC2", "cloud9:CreateEnvironmentSSH" ], "Resource": "*", "Condition": { "Null": { "cloud9:OwnerArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:GetUserPublicKey" ], "Resource": "*", "Condition": { "Null": { "cloud9:UserArn": "true" } } }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:GetConnectionStatus" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } } }, "createdDate": "2017-11-30T16:16:17.000Z", "lastUpdatedDate": "2025-01-27T10:07:06.000Z" }, "AWSCloud9Administrator": { "arn": "arn:aws:iam::aws:policy/AWSCloud9Administrator", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-11-30T16:17:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:*", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2020-07-29T06:28:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:*", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v3": { "createdDate": "2023-08-02T08:54:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:*", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v4": { "createdDate": "2017-11-30T16:17:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:*", "iam:GetUser", "iam:ListUsers", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:GetConnectionStatus" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } } }, "createdDate": "2017-11-30T16:17:28.000Z", "lastUpdatedDate": "2023-10-11T12:59:29.000Z" }, "AWSCloud9EnvironmentMember": { "arn": "arn:aws:iam::aws:policy/AWSCloud9EnvironmentMember", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-11-30T16:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:GetUserSettings", "cloud9:UpdateUserSettings", "iam:GetUser", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } } ] } }, "v2": { "createdDate": "2020-07-29T06:29:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:GetUserSettings", "cloud9:UpdateUserSettings", "iam:GetUser", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v3": { "createdDate": "2017-11-30T16:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:GetUserSettings", "cloud9:UpdateUserSettings", "iam:GetUser", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:GetConnectionStatus" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } }, "v4": { "createdDate": "2017-11-30T16:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloud9:GetUserSettings", "cloud9:UpdateUserSettings", "cloud9:GetMigrationExperiences", "iam:GetUser", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloud9:DescribeEnvironmentMemberships" ], "Resource": [ "*" ], "Condition": { "Null": { "cloud9:UserArn": "true", "cloud9:EnvironmentId": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:GetConnectionStatus" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/aws:cloud9:environment": "*" }, "StringEquals": { "aws:CalledViaFirst": "cloud9.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] } ] } } }, "createdDate": "2017-11-30T16:18:28.000Z", "lastUpdatedDate": "2025-01-27T10:07:07.000Z" }, "AlexaForBusinessFullAccess": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2017-11-30T16:47:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-06-25T23:53:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:*", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-03-13T00:46:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:*", "kms:DescribeKey" ], "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "*a4b.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/*a4b.amazonaws.com/AWSServiceRoleForAlexaForBusiness*" } ] } }, "v4": { "createdDate": "2019-05-20T21:32:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:*", "kms:DescribeKey" ], "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "*a4b.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/*a4b.amazonaws.com/AWSServiceRoleForAlexaForBusiness*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:A4BNetworkProfile*" }, { "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": "A4BNetworkProfile*" } } } ] } }, "v5": { "createdDate": "2020-07-01T21:01:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:*", "kms:DescribeKey" ], "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "*a4b.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/*a4b.amazonaws.com/AWSServiceRoleForAlexaForBusiness*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:A4B*" }, { "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": "A4B*" } } } ] } } }, "createdDate": "2017-11-30T16:47:09.000Z", "lastUpdatedDate": "2020-07-01T21:01:55.000Z" }, "AlexaForBusinessReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-11-30T16:47:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-06-25T23:52:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Describe*", "a4b:Search*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-20T00:25:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Get*", "a4b:List*", "a4b:Search*" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-30T16:47:12.000Z", "lastUpdatedDate": "2019-11-20T00:25:33.000Z" }, "AlexaForBusinessDeviceSetup": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2017-11-30T16:47:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:RegisterDevice", "a4b:CompleteRegistration", "a4b:SearchDevices" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-20T21:05:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:RegisterDevice", "a4b:CompleteRegistration", "a4b:SearchDevices", "a4b:SearchNetworkProfiles", "a4b:GetNetworkProfile", "a4b:PutDeviceSetupEvents" ], "Resource": "*" }, { "Sid": "A4bDeviceSetupAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:A4BNetworkProfile*" } ] } } }, "createdDate": "2017-11-30T16:47:16.000Z", "lastUpdatedDate": "2019-05-20T21:05:39.000Z" }, "AlexaForBusinessGatewayExecution": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessGatewayExecution", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-11-30T16:47:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:Send*", "a4b:Get*" ], "Resource": "arn:aws:a4b:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage" ], "Resource": [ "arn:aws:sqs:*:*:dd-*", "arn:aws:sqs:*:*:sd-*" ] }, { "Effect": "Allow", "Action": [ "a4b:List*", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2017-11-30T16:47:19.000Z", "lastUpdatedDate": "2017-11-30T16:47:19.000Z" }, "AWSIoTThingsRegistration": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTThingsRegistration", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2017-12-01T20:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CreateCertificateFromCsr", "iot:CreatePolicy", "iot:CreateThing", "iot:DescribeCertificate", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:DetachThingPrincipal", "iot:GetPolicy", "iot:ListPolicyPrincipals", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RemoveThingFromThingGroup", "iot:UpdateCertificate", "iot:UpdateThing", "iot:UpdateThingGroupsForThing" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-02-27T23:27:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CreateCertificateFromCsr", "iot:CreatePolicy", "iot:CreateThing", "iot:DescribeCertificate", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:DetachThingPrincipal", "iot:GetPolicy", "iot:ListPolicyPrincipals", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RemoveThingFromThingGroup", "iot:UpdateCertificate", "iot:UpdateThing", "iot:UpdateThingGroupsForThing", "iot:AddThingToBillingGroup", "iot:DescribeBillingGroup", "iot:RemoveThingFromBillingGroup" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2020-10-05T19:20:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachPrincipalPolicy", "iot:AttachThingPrincipal", "iot:CreateCertificateFromCsr", "iot:CreatePolicy", "iot:CreateThing", "iot:DescribeCertificate", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachThingPrincipal", "iot:GetPolicy", "iot:ListAttachedPolicies", "iot:ListPolicyPrincipals", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListTargetsForPolicy", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:RegisterCertificate", "iot:RegisterThing", "iot:RemoveThingFromThingGroup", "iot:UpdateCertificate", "iot:UpdateThing", "iot:UpdateThingGroupsForThing", "iot:AddThingToBillingGroup", "iot:DescribeBillingGroup", "iot:RemoveThingFromBillingGroup" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2017-12-01T20:21:52.000Z", "lastUpdatedDate": "2020-10-05T19:20:12.000Z" }, "AmazonKinesisVideoStreamsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisVideoStreamsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-12-01T23:14:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*" ], "Resource": "*" } ] } } }, "createdDate": "2017-12-01T23:14:32.000Z", "lastUpdatedDate": "2017-12-01T23:14:32.000Z" }, "AmazonKinesisVideoStreamsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKinesisVideoStreamsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-12-01T23:27:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kinesisvideo:*", "Resource": "*" } ] } } }, "createdDate": "2017-12-01T23:27:18.000Z", "lastUpdatedDate": "2017-12-01T23:27:18.000Z" }, "AWSSSOServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", "latestVersionId": "v18", "versionsCount": 18, "versions": { "v2": { "createdDate": "2017-12-06T19:34:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForPeregrine", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2017-12-05T18:36:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForPeregrine", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2017-12-06T20:41:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForPeregrine", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2018-10-29T17:17:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2019-02-05T18:20:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-05-15T20:45:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2020-03-12T20:36:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2020-07-02T20:20:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2019-08-30T19:55:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetRole", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2020-08-26T17:46:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2020-07-24T22:05:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:PutRolePolicy", "iam:ListAttachedRolePolicies", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "ListRolesInTheAccount", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "AllowDeletionOfServiceLinkedRoleForSSO", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:GetSAMLProvider", "iam:UpdateSAMLProvider", "iam:DeleteSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] } ] } }, "v13": { "createdDate": "2020-11-19T00:02:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderProvisioningActions", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v12": { "createdDate": "2020-10-21T20:27:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderProvisioningActions", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v15": { "createdDate": "2022-05-12T21:14:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderProvisioningActions", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v14": { "createdDate": "2022-05-03T16:12:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderProvisioningActions", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v16": { "createdDate": "2022-06-28T20:08:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderProvisioningActions", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider", "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v17": { "createdDate": "2022-10-20T20:05:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderCreationAction", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderUpdateAction", "Effect": "Allow", "Action": [ "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] } ] } }, "v18": { "createdDate": "2017-12-05T18:36:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMRoleProvisioningActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:PutRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:UpdateAssumeRolePolicy", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleReadActions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "IAMRoleCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*" ] }, { "Sid": "IAMSLRCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:DeleteRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" ] }, { "Sid": "IAMSAMLProviderCreationAction", "Effect": "Allow", "Action": [ "iam:CreateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ], "Condition": { "StringNotEquals": { "aws:PrincipalOrgMasterAccountId": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMSAMLProviderUpdateAction", "Effect": "Allow", "Action": [ "iam:UpdateSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Sid": "IAMSAMLProviderCleanupActions", "Effect": "Allow", "Action": [ "iam:DeleteSAMLProvider", "iam:GetSAMLProvider" ], "Resource": [ "arn:aws:iam::*:saml-provider/AWSSSO_*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AllowUnauthAppForDirectory", "Effect": "Allow", "Action": [ "ds:UnauthorizeApplication" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeForDirectory", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": [ "*" ] }, { "Sid": "AllowDescribeAndListOperationsOnIdentitySource", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroups", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSyncProfile", "Effect": "Allow", "Action": [ "identity-sync:DeleteSyncProfile" ], "Resource": [ "arn:aws:identity-sync:*:*:profile/*" ] } ] } } }, "createdDate": "2017-12-05T18:36:15.000Z", "lastUpdatedDate": "2025-02-11T18:37:06.000Z" }, "ElastiCacheServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2017-12-07T17:50:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-25T23:09:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", "cloudwatch:PutMetricData" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-02-06T21:27:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", "cloudwatch:PutMetricData", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2017-12-07T17:50:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElastiCacheManagementActions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", "cloudwatch:PutMetricData", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites" ], "Resource": "*" }, { "Sid": "CreateDeleteVPCEndpoints", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringLike": { "ec2:VpceServiceName": "com.amazonaws.elasticache.serverless.*" } } }, { "Sid": "TagVPCEndpointsOnCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/AmazonElastiCacheManaged": "true" } } }, { "Sid": "ModifyVpcEndpoints", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AmazonElastiCacheManaged": "true" } } }, { "Sid": "AllowAccessToElastiCacheTaggedVpcEndpoints", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "NotResource": "arn:aws:ec2:*:*:vpc-endpoint/*" } ] } } }, "createdDate": "2017-12-07T17:50:04.000Z", "lastUpdatedDate": "2023-11-28T03:05:37.000Z" }, "AWSIoTOTAUpdate": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTOTAUpdate", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-12-20T20:36:53.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "iot:CreateJob", "signer:DescribeSigningJob" ], "Resource": "*" } } } }, "createdDate": "2017-12-20T20:36:53.000Z", "lastUpdatedDate": "2017-12-20T20:36:53.000Z" }, "AWSElementalMediaPackageFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaPackageFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-12-29T23:39:52.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "mediapackage:*", "Resource": "*" } } } }, "createdDate": "2017-12-29T23:39:52.000Z", "lastUpdatedDate": "2017-12-29T23:39:52.000Z" }, "AWSElementalMediaPackageReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaPackageReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2017-12-30T00:04:29.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "mediapackage:List*", "mediapackage:Describe*" ], "Resource": "*" } } } }, "createdDate": "2017-12-30T00:04:29.000Z", "lastUpdatedDate": "2017-12-30T00:04:29.000Z" }, "AmazonRDSServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2018-01-08T18:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v2": { "createdDate": "2018-07-10T15:54:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v3": { "createdDate": "2018-10-16T19:47:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v4": { "createdDate": "2018-11-19T22:40:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] } ] } }, "v5": { "createdDate": "2019-02-04T18:16:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] } ] } }, "v6": { "createdDate": "2019-04-16T20:12:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] } ] } }, "v7": { "createdDate": "2020-07-31T01:14:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v8": { "createdDate": "2020-10-21T22:31:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v9": { "createdDate": "2020-11-21T00:08:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v10": { "createdDate": "2022-02-24T01:07:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS" ] } } } ] } }, "v12": { "createdDate": "2022-12-13T16:24:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } } ] } }, "v11": { "createdDate": "2022-03-21T15:03:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } } ] } }, "v13": { "createdDate": "2018-01-08T18:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CrossRegionCommunication", "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Sid": "Ec2", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Sid": "Sns", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "CloudWatchLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Sid": "CloudWatchStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Sid": "Kinesis", "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Sid": "SecretsManagerPassword", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Sid": "SecretsManagerSecret", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } }, { "Sid": "SecretsManagerTags", "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } } ] } }, "v14": { "createdDate": "2018-01-08T18:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CrossRegionCommunication", "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Sid": "Ec2", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Sid": "CloudWatchLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*", "arn:aws:logs:*:*:log-group:/aws/docdb/*", "arn:aws:logs:*:*:log-group:/aws/neptune/*" ] }, { "Sid": "CloudWatchStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Sid": "Kinesis", "Effect": "Allow", "Action": [ "kinesis:CreateStream", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream", "kinesis:SplitShard", "kinesis:MergeShards", "kinesis:DeleteStream", "kinesis:UpdateShardCount" ], "Resource": [ "arn:aws:kinesis:*:*:stream/aws-rds-das-*" ] }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Sid": "SecretsManagerPassword", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Sid": "SecretsManagerSecret", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } }, { "Sid": "SecretsManagerTags", "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds" } } } ] } } }, "createdDate": "2018-01-08T18:17:46.000Z", "lastUpdatedDate": "2024-07-01T22:42:05.000Z" }, "AutoScalingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2018-01-08T23:10:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-10-31T18:19:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-10-30T00:01:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2021-02-05T01:37:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2021-03-29T22:33:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2021-10-29T22:06:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } }, { "Sid": "SystemsManagerParameterManagement", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-12-06T20:15:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } }, { "Sid": "SystemsManagerParameterManagement", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VpcLatticeManagement", "Effect": "Allow", "Action": [ "vpc-lattice:DeregisterTargets", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListTargets", "vpc-lattice:ListTargetGroups", "vpc-lattice:RegisterTargets" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2018-01-08T23:10:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } }, { "Sid": "SystemsManagerParameterManagement", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VpcLatticeManagement", "Effect": "Allow", "Action": [ "vpc-lattice:DeregisterTargets", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListTargets", "vpc-lattice:ListTargetGroups", "vpc-lattice:RegisterTargets" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2018-01-08T23:10:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceManagement", "Effect": "Allow", "Action": [ "ec2:AttachClassicLinkVpc", "ec2:CancelSpotInstanceRequests", "ec2:CreateFleet", "ec2:CreateTags", "ec2:DeleteTags", "ec2:Describe*", "ec2:DetachClassicLinkVpc", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetSecurityGroupsForVpc", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*" }, { "Sid": "EC2InstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Sid": "ELBManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:Register*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "CWManagement", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "SNSManagement", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "autoscaling.amazonaws.com" } } }, { "Sid": "SystemsManagerParameterManagement", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VpcLatticeManagement", "Effect": "Allow", "Action": [ "vpc-lattice:DeregisterTargets", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListTargets", "vpc-lattice:ListTargetGroups", "vpc-lattice:RegisterTargets" ], "Resource": "*" }, { "Sid": "ResourceGroupsManagement", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "arn:*:resource-groups:*:*:group/*" } ] } } }, "createdDate": "2018-01-08T23:10:55.000Z", "lastUpdatedDate": "2024-11-15T17:10:25.000Z" }, "AmazonRoute53AutoNamingReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53AutoNamingReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-01-18T03:02:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicediscovery:Get*", "servicediscovery:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-01-18T03:02:59.000Z", "lastUpdatedDate": "2018-01-18T03:02:59.000Z" }, "AmazonRoute53AutoNamingFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53AutoNamingFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-01-18T18:40:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "ec2:DescribeVpcs", "ec2:DescribeRegions", "servicediscovery:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-01-18T18:40:41.000Z", "lastUpdatedDate": "2018-01-18T18:40:41.000Z" }, "AWSApplicationAutoscalingSageMakerEndpointPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingSageMakerEndpointPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-02-06T19:58:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:UpdateEndpointWeightsAndCapacities", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-02-06T19:58:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMaker", "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeInferenceComponent", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "SageMakerCloudWatchUpdate", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ] } ] } } }, "createdDate": "2018-02-06T19:58:21.000Z", "lastUpdatedDate": "2023-11-13T18:52:34.000Z" }, "AWSServiceCatalogAdminFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogAdminFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2018-02-15T17:19:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-09-29T00:29:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-10-16T23:15:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:*", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2018-11-02T23:07:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:*", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2019-02-06T01:57:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:*", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2022-11-17T23:03:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:Get*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:List*", "servicecatalog:TagResource", "servicecatalog:UntagResource", "servicecatalog:SyncResource", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:Accept*", "servicecatalog:Associate*", "servicecatalog:Batch*", "servicecatalog:Copy*", "servicecatalog:Create*", "servicecatalog:Delete*", "servicecatalog:Describe*", "servicecatalog:Disable*", "servicecatalog:Disassociate*", "servicecatalog:Enable*", "servicecatalog:Execute*", "servicecatalog:Import*", "servicecatalog:Provision*", "servicecatalog:Reject*", "servicecatalog:Terminate*", "servicecatalog:Update*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2023-01-11T18:08:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:Get*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:List*", "servicecatalog:TagResource", "servicecatalog:UntagResource", "servicecatalog:SyncResource", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:Accept*", "servicecatalog:Associate*", "servicecatalog:Batch*", "servicecatalog:Copy*", "servicecatalog:Create*", "servicecatalog:Delete*", "servicecatalog:Describe*", "servicecatalog:Disable*", "servicecatalog:Disassociate*", "servicecatalog:Enable*", "servicecatalog:Execute*", "servicecatalog:Import*", "servicecatalog:Provision*", "servicecatalog:Put*", "servicecatalog:Reject*", "servicecatalog:Terminate*", "servicecatalog:Update*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2023-04-13T18:43:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:Get*", "servicecatalog:Scan*", "servicecatalog:Search*", "servicecatalog:List*", "servicecatalog:TagResource", "servicecatalog:UntagResource", "servicecatalog:SyncResource", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:Accept*", "servicecatalog:Associate*", "servicecatalog:Batch*", "servicecatalog:Copy*", "servicecatalog:Create*", "servicecatalog:Delete*", "servicecatalog:Describe*", "servicecatalog:Disable*", "servicecatalog:Disassociate*", "servicecatalog:Enable*", "servicecatalog:Execute*", "servicecatalog:Import*", "servicecatalog:Provision*", "servicecatalog:Put*", "servicecatalog:Reject*", "servicecatalog:Terminate*", "servicecatalog:Update*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "servicecatalog.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/orgsdatasync.servicecatalog.amazonaws.com/AWSServiceRoleForServiceCatalogOrgsDataSync", "Condition": { "StringEquals": { "iam:AWSServiceName": "orgsdatasync.servicecatalog.amazonaws.com" } } } ] } } }, "createdDate": "2018-02-15T17:19:40.000Z", "lastUpdatedDate": "2023-04-13T18:43:01.000Z" }, "AWSServiceCatalogEndUserFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-02-15T17:22:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v2": { "createdDate": "2018-09-29T00:30:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v3": { "createdDate": "2018-10-22T18:55:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:ExecuteProvisionedProductServiceAction" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v4": { "createdDate": "2018-11-02T23:06:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:ExecuteProvisionedProductServiceAction" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v5": { "createdDate": "2019-02-06T02:00:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:ExecuteProvisionedProductServiceAction" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v6": { "createdDate": "2019-06-18T22:04:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ListStackInstancesForProvisionedProduct", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:ExecuteProvisionedProductServiceAction" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } }, "v7": { "createdDate": "2019-07-10T20:30:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStackSet", "cloudformation:CreateStackInstances", "cloudformation:UpdateStackSet", "cloudformation:UpdateStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:ProvisionProduct", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ListStackInstancesForProvisionedProduct", "servicecatalog:ScanProvisionedProducts", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "servicecatalog:SearchProvisionedProducts", "servicecatalog:CreateProvisionedProductPlan", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ExecuteProvisionedProductPlan", "servicecatalog:DeleteProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:ExecuteProvisionedProductServiceAction", "servicecatalog:DescribeServiceActionExecutionParameters" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } } }, "createdDate": "2018-02-15T17:22:32.000Z", "lastUpdatedDate": "2019-07-10T20:30:52.000Z" }, "AWSTrustedAdvisorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:ListBucket", "s3:ListObjects", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2018-08-21T22:29:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:ListBucket", "s3:ListObjects", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2018-10-08T21:27:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:ListBucket", "s3:ListObjects", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2019-01-22T19:58:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListObjects", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-12-13T21:54:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetPublicAccessBlock", "s3:ListBucket", "s3:ListObjects", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2019-06-12T21:21:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics", "ce:GetReservationPurchaseRecommendation" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2019-11-15T22:11:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics", "ce:GetReservationPurchaseRecommendation" ], "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2021-08-10T22:41:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-04-08T16:15:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues", "cloudwatch:GetMetricStatistics", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "ec2:DescribeSubnets", "kafka:ListClustersV2", "kafka:ListNodes" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedAdvisorServiceRolePermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:GetMetricStatistics", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeTaskDefinition", "ecs:ListTaskDefinitions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "kafka:ListClustersV2", "kafka:ListNodes", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetLifecycleConfiguration", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedAdvisorServiceRolePermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:GetEventSelectors", "cloudwatch:GetMetricStatistics", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeTaskDefinition", "ecs:ListTaskDefinitions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "kinesis:DescribeLimits", "kafka:ListClustersV2", "kafka:ListNodes", "outposts:ListAssets", "outposts:GetOutpost", "outposts:ListOutposts", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetLifecycleConfiguration", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedAdvisorServiceRolePermissions", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:GetEventSelectors", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "dax:DescribeClusters", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeNatGateways", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "ec2:GetManagedPrefixListEntries", "ecs:DescribeTaskDefinition", "ecs:ListTaskDefinitions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "iam:ListSAMLProviders", "kinesis:DescribeLimits", "kafka:DescribeClusterV2", "kafka:ListClustersV2", "kafka:ListNodes", "network-firewall:ListFirewalls", "network-firewall:DescribeFirewall", "outposts:ListAssets", "outposts:GetOutpost", "outposts:ListOutposts", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetLifecycleConfiguration", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2018-02-22T21:24:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedAdvisorServiceRolePermissions", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "ce:GetReservationPurchaseRecommendation", "ce:GetSavingsPlansPurchaseRecommendation", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:GetEventSelectors", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "dax:DescribeClusters", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeReservedInstances", "ec2:DescribeInstances", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", "ec2:DescribeNatGateways", "ec2:DescribeVolumes", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeLaunchTemplateVersions", "ec2:GetManagedPrefixListEntries", "ecs:DescribeTaskDefinition", "ecs:ListTaskDefinitions", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetServerCertificate", "iam:ListServerCertificates", "iam:ListSAMLProviders", "kinesis:DescribeLimits", "kafka:DescribeClusterV2", "kafka:ListClustersV2", "kafka:ListNodes", "network-firewall:ListFirewalls", "network-firewall:DescribeFirewall", "outposts:ListAssets", "outposts:GetOutpost", "outposts:ListOutposts", "rds:DescribeAccountAttributes", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEvents", "rds:DescribeOptionGroupOptions", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeReservedDBInstances", "rds:DescribeReservedDBInstancesOfferings", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodeOfferings", "redshift:DescribeReservedNodes", "route53:GetAccountLimit", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetLifecycleConfiguration", "s3:ListBucket", "s3:ListAllMyBuckets", "ses:GetSendQuota", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } } }, "createdDate": "2018-02-22T21:24:25.000Z", "lastUpdatedDate": "2024-10-30T16:52:06.000Z" }, "AmazonESCognitoAccess": { "arn": "arn:aws:iam::aws:policy/AmazonESCognitoAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-02-28T22:29:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPoolClient", "cognito-idp:AdminInitiateAuth", "cognito-idp:AdminUserGlobalSignOut", "cognito-idp:ListUserPoolClients", "cognito-identity:DescribeIdentityPool", "cognito-identity:UpdateIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "cognito-identity.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-12-20T14:04:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPoolClient", "cognito-idp:UpdateUserPoolClient", "cognito-idp:DescribeUserPoolClient", "cognito-idp:AdminInitiateAuth", "cognito-idp:AdminUserGlobalSignOut", "cognito-idp:ListUserPoolClients", "cognito-identity:DescribeIdentityPool", "cognito-identity:UpdateIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "cognito-identity.amazonaws.com", "cognito-identity-us-gov.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-02-28T22:29:18.000Z", "lastUpdatedDate": "2021-12-20T14:04:44.000Z" }, "AWSBatchServiceEventTargetRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSBatchServiceEventTargetRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-02-28T22:31:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "batch:SubmitJob" ], "Resource": "*" } ] } } }, "createdDate": "2018-02-28T22:31:13.000Z", "lastUpdatedDate": "2018-02-28T22:31:13.000Z" }, "DAXServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/DAXServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-03-05T17:51:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } } }, "createdDate": "2018-03-05T17:51:25.000Z", "lastUpdatedDate": "2018-03-05T17:51:25.000Z" }, "AWSElementalMediaStoreFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaStoreFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-03-05T23:15:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mediastore:*" ], "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "aws:SecureTransport": "true" } } } ] } } }, "createdDate": "2018-03-05T23:15:31.000Z", "lastUpdatedDate": "2018-03-05T23:15:31.000Z" }, "CloudWatchAgentAdminPolicy": { "arn": "arn:aws:iam::aws:policy/CloudWatchAgentAdminPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-03-07T00:52:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:DescribeTags", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*" } ] } }, "v2": { "createdDate": "2018-03-07T00:52:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CWACloudWatchPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:DescribeTags", "logs:PutLogEvents", "logs:PutRetentionPolicy", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Resource": "*" }, { "Sid": "CWASSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*" } ] } } }, "createdDate": "2018-03-07T00:52:31.000Z", "lastUpdatedDate": "2024-02-05T20:59:57.000Z" }, "CloudWatchAgentServerPolicy": { "arn": "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-03-07T01:06:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:DescribeTags", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*" } ] } }, "v2": { "createdDate": "2019-10-17T23:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:DescribeVolumes", "ec2:DescribeTags", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*" } ] } }, "v3": { "createdDate": "2018-03-07T01:06:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CWACloudWatchServerPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:DescribeVolumes", "ec2:DescribeTags", "logs:PutLogEvents", "logs:PutRetentionPolicy", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup", "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Resource": "*" }, { "Sid": "CWASSMServerPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*" } ] } } }, "createdDate": "2018-03-07T01:06:44.000Z", "lastUpdatedDate": "2024-02-06T16:37:37.000Z" }, "AWSResourceGroupsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2019-02-05T17:56:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "tag:Get*", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "elasticache:DescribeCacheClusters", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeEnvironments", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListClusters", "glacier:ListVaults", "glacier:DescribeVault", "glacier:ListTagsForVault", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:ListTagsForStream", "opsworks:DescribeStacks", "opsworks:ListTags", "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeTags", "route53domains:ListDomains", "route53:ListHealthChecks", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:GetHostedZone", "route53:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:DescribeGatewayInformation", "storagegateway:ListTagsForResource", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "ssm:ListDocuments" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2018-03-07T10:27:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "resource-groups:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "tag:Get*", "cloudformation:DescribeStacks", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "elasticache:DescribeCacheClusters", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeEnvironments", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListClusters", "glacier:ListVaults", "glacier:DescribeVault", "glacier:ListTagsForVault", "kinesis:ListStreams", "kinesis:DescribeStream", "kinesis:ListTagsForStream", "opsworks:DescribeStacks", "opsworks:ListTags", "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeTags", "route53domains:ListDomains", "route53:ListHealthChecks", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:GetHostedZone", "route53:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:DescribeGatewayInformation", "storagegateway:ListTagsForResource", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "ssm:ListDocuments" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-03-07T10:27:04.000Z", "lastUpdatedDate": "2019-02-05T17:56:25.000Z" }, "AWSElementalMediaStoreReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaStoreReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-03-08T19:48:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mediastore:Get*", "mediastore:List*", "mediastore:Describe*" ], "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "aws:SecureTransport": "true" } } } ] } } }, "createdDate": "2018-03-08T19:48:22.000Z", "lastUpdatedDate": "2018-03-08T19:48:22.000Z" }, "AmazonRoute53AutoNamingRegistrantAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53AutoNamingRegistrantAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-03-12T22:33:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:DeregisterInstance" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-03-12T22:33:20.000Z", "lastUpdatedDate": "2018-03-12T22:33:20.000Z" }, "AWSConfigRoleForOrganizations": { "arn": "arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-03-19T22:53:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-11-24T20:19:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } } }, "createdDate": "2018-03-19T22:53:01.000Z", "lastUpdatedDate": "2020-11-24T20:19:13.000Z" }, "AWSAppSyncAdministrator": { "arn": "arn:aws:iam::aws:policy/AWSAppSyncAdministrator", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-03-20T21:20:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "appsync.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2019-11-04T19:23:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "appsync.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "appsync.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appsync.amazonaws.com/AWSServiceRoleForAppSync*" } ] } } }, "createdDate": "2018-03-20T21:20:28.000Z", "lastUpdatedDate": "2019-11-04T19:23:49.000Z" }, "AWSAppSyncSchemaAuthor": { "arn": "arn:aws:iam::aws:policy/AWSAppSyncSchemaAuthor", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-03-20T21:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:GraphQL", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetResolver", "appsync:GetType", "appsync:GetDataSource", "appsync:GetSchemaCreationStatus", "appsync:GetIntrospectionSchema", "appsync:GetGraphqlApi", "appsync:ListTypes", "appsync:ListApiKeys", "appsync:ListResolvers", "appsync:ListDataSources", "appsync:ListGraphqlApis", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:UpdateType" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-08-25T17:18:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:GraphQL", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetResolver", "appsync:GetType", "appsync:GetDataSource", "appsync:GetSchemaCreationStatus", "appsync:GetIntrospectionSchema", "appsync:GetGraphqlApi", "appsync:ListTypes", "appsync:ListApiKeys", "appsync:ListResolvers", "appsync:ListDataSources", "appsync:ListGraphqlApis", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:UntagResource", "appsync:ListTagsForResource", "appsync:CreateFunction", "appsync:UpdateFunction", "appsync:GetFunction", "appsync:DeleteFunction", "appsync:ListFunctions", "appsync:ListResolversByFunction", "appsync:EvaluateMappingTemplate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-02-01T18:36:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:GraphQL", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetResolver", "appsync:GetType", "appsync:GetDataSource", "appsync:GetSchemaCreationStatus", "appsync:GetIntrospectionSchema", "appsync:GetGraphqlApi", "appsync:ListTypes", "appsync:ListApiKeys", "appsync:ListResolvers", "appsync:ListDataSources", "appsync:ListGraphqlApis", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:UntagResource", "appsync:ListTagsForResource", "appsync:CreateFunction", "appsync:UpdateFunction", "appsync:GetFunction", "appsync:DeleteFunction", "appsync:ListFunctions", "appsync:ListResolversByFunction", "appsync:EvaluateMappingTemplate", "appsync:EvaluateCode" ], "Resource": "*" } ] } } }, "createdDate": "2018-03-20T21:21:06.000Z", "lastUpdatedDate": "2023-02-01T18:36:20.000Z" }, "AWSAppSyncInvokeFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-03-20T21:21:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appsync:GraphQL", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "appsync:ListApiKeys" ], "Resource": "*" } ] } } }, "createdDate": "2018-03-20T21:21:20.000Z", "lastUpdatedDate": "2018-03-20T21:21:20.000Z" }, "AWSEC2FleetServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSEC2FleetServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-03-21T00:08:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2:fleet-id": "*" } } } ] } }, "v2": { "createdDate": "2018-04-19T21:37:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2:fleet-id": "*" } } } ] } }, "v3": { "createdDate": "2020-05-04T20:10:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:RequestSpotInstances", "ec2:DescribeInstanceStatus", "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Sid": "EC2SpotManagement", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "spot.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2:fleet-id": "*" } } } ] } } }, "createdDate": "2018-03-21T00:08:55.000Z", "lastUpdatedDate": "2020-05-04T20:10:31.000Z" }, "FMSServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", "latestVersionId": "v31", "versionsCount": 31, "versions": { "v1": { "createdDate": "2018-03-28T23:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutConfigRule" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-08-29T17:46:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-04-02T19:16:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2019-01-21T21:12:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2019-03-08T18:02:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2019-02-18T19:12:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-03-09T22:10:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v10": { "createdDate": "2020-03-10T20:10:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v8": { "createdDate": "2019-08-14T21:35:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2020-04-06T18:55:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v13": { "createdDate": "2020-07-20T23:05:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v12": { "createdDate": "2020-05-12T21:02:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v16": { "createdDate": "2020-09-08T18:03:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v14": { "createdDate": "2020-07-28T16:30:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v15": { "createdDate": "2020-08-05T23:22:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] } ] } }, "v17": { "createdDate": "2020-11-17T17:35:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries" ], "Resource": "*" } ] } }, "v18": { "createdDate": "2021-03-31T21:02:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v20": { "createdDate": "2021-09-30T17:12:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v19": { "createdDate": "2021-08-12T19:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v21": { "createdDate": "2021-11-18T19:05:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v22": { "createdDate": "2022-01-06T21:30:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v23": { "createdDate": "2022-02-16T18:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v24": { "createdDate": "2022-03-28T21:09:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v25": { "createdDate": "2022-06-24T20:29:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v26": { "createdDate": "2022-11-15T20:51:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v27": { "createdDate": "2023-02-03T23:53:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:DescribeComplianceByConfigRule", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v28": { "createdDate": "2023-04-21T18:33:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "ram", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } } ] } }, "v29": { "createdDate": "2018-03-28T23:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WafGeneral", "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Sid": "Wafv2Logging", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Sid": "WafWebaclCreation", "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Sid": "ElbGeneral", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Sid": "WafPermissionPolicy", "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Sid": "CloudfrontGeneral", "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ConfigScoped", "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation", "config:DeleteEvaluationResults" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Sid": "ConfigUnscoped", "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Sid": "SlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Sid": "OrganizationsGeneral", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "ShieldGeneral", "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Sid": "EC2SecurityGroupScoped", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SecurityGroupTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "SecurityGroupTagManagement", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Sid": "Ec2Unscoped", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": [ "*" ] }, { "Sid": "Wafv2General", "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "Wafv2WebAclAndRuleGroupMutation", "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Sid": "Wafv2PermissionPolicy", "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Sid": "Wafv2WebaclDescribe", "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "RouteTableTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "SubnetTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "VPCEndpointTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RouteTableCleanup", "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "Ec2DescribeUnscoped", "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "CreateVpcEndpointScoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "CreateVpcEndpointUnscoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "VpcEndpointsDeletion", "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamTagManagement", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RamMutation", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamCreation", "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "RamDescribe", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "SlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Sid": "IamDescribe", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Sid": "NetworkFirewallTagManagement", "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "NetworkFirewallGeneral", "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration" ], "Resource": "*" }, { "Sid": "NetworkFirewallCleanup", "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "LogsGeneral", "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupUnscoped", "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupCleanup", "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "Route53ResolverRuleGroupScoped", "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } }, { "Sid": "NaclTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl" } } }, { "Sid": "NaclTagManagement", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclScoped", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkAclEntry", "ec2:CreateNetworkAclEntry", "ec2:ReplaceNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclUnscoped", "Effect": "Allow", "Action": [ "ec2:ReplaceNetworkAclAssociation", "ec2:DescribeNetworkAcls", "ec2:CreateNetworkAcl" ], "Resource": "*" } ] } }, "v30": { "createdDate": "2018-03-28T23:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WafGeneral", "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Sid": "Wafv2Logging", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Sid": "WafWebaclCreation", "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Sid": "ElbGeneral", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Sid": "WafPermissionPolicy", "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Sid": "CloudfrontGeneral", "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ConfigScoped", "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation", "config:DeleteEvaluationResults" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Sid": "ConfigUnscoped", "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig" ], "Resource": "*" }, { "Sid": "SlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Sid": "OrganizationsGeneral", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "ShieldGeneral", "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Sid": "EC2SecurityGroupScoped", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SecurityGroupTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "SecurityGroupTagManagement", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Sid": "Ec2Unscoped", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": [ "*" ] }, { "Sid": "Wafv2General", "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "Wafv2WebAclAndRuleGroupMutation", "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Sid": "Wafv2PermissionPolicy", "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Sid": "Wafv2WebaclDescribe", "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "RouteTableTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "SubnetTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "VPCEndpointTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RouteTableCleanup", "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "Ec2DescribeUnscoped", "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "CreateVpcEndpointScoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "CreateVpcEndpointUnscoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "VpcEndpointsDeletion", "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamTagManagement", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RamMutation", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamCreation", "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "RamDescribe", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "SlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Sid": "IamDescribe", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Sid": "NetworkFirewallTagManagement", "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "NetworkFirewallGeneral", "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:PutResourcePolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListTLSInspectionConfigurations" ], "Resource": "*" }, { "Sid": "NetworkFirewallCleanup", "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "LogsGeneral", "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupUnscoped", "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupCleanup", "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "Route53ResolverRuleGroupScoped", "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } }, { "Sid": "NaclTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl" } } }, { "Sid": "NaclTagManagement", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclScoped", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkAclEntry", "ec2:CreateNetworkAclEntry", "ec2:ReplaceNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclUnscoped", "Effect": "Allow", "Action": [ "ec2:ReplaceNetworkAclAssociation", "ec2:DescribeNetworkAcls", "ec2:CreateNetworkAcl" ], "Resource": "*" } ] } }, "v31": { "createdDate": "2018-03-28T23:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WafGeneral", "Effect": "Allow", "Action": [ "waf:UpdateWebACL", "waf:DeleteWebACL", "waf:GetWebACL", "waf:GetRuleGroup", "waf:ListSubscribedRuleGroups", "waf-regional:UpdateWebACL", "waf-regional:DeleteWebACL", "waf-regional:GetWebACL", "waf-regional:GetRuleGroup", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListResourcesForWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "elasticloadbalancing:SetSecurityGroups", "waf:ListTagsForResource", "waf-regional:ListTagsForResource" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:rulegroup/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Sid": "Wafv2Logging", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/webacl/*" ] }, { "Sid": "WafWebaclCreation", "Effect": "Allow", "Action": [ "waf:CreateWebACL", "waf-regional:CreateWebACL", "waf:GetChangeToken", "waf-regional:GetChangeToken", "waf-regional:GetWebACLForResource" ], "Resource": [ "arn:aws:waf:*:*:*", "arn:aws:waf-regional:*:*:*" ] }, { "Sid": "ElbGeneral", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:DescribeTags" ], "Resource": "*" }, { "Sid": "WafPermissionPolicy", "Effect": "Allow", "Action": [ "waf:PutPermissionPolicy", "waf:GetPermissionPolicy", "waf:DeletePermissionPolicy", "waf-regional:PutPermissionPolicy", "waf-regional:GetPermissionPolicy", "waf-regional:DeletePermissionPolicy" ], "Resource": [ "arn:aws:waf:*:*:webacl/*", "arn:aws:waf:*:*:rulegroup/*", "arn:aws:waf-regional:*:*:webacl/*", "arn:aws:waf-regional:*:*:rulegroup/*" ] }, { "Sid": "CloudfrontGeneral", "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "cloudfront:UpdateDistribution", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ConfigScoped", "Effect": "Allow", "Action": [ "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:StartConfigRulesEvaluation", "config:DeleteEvaluationResults" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*" }, { "Sid": "ConfigUnscoped", "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:PutConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "config:DescribeDeliveryChannels", "config:DescribeDeliveryChannelStatus", "config:GetComplianceSummaryByConfigRule", "config:GetDiscoveredResourceCounts", "config:PutEvaluations", "config:SelectResourceConfig", "config:BatchGetResourceConfig" ], "Resource": "*" }, { "Sid": "SlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS" ] }, { "Sid": "OrganizationsGeneral", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeOrganizationalUnit", "organizations:ListChildren", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "ShieldGeneral", "Effect": "Allow", "Action": [ "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeProtection", "shield:ListProtections", "shield:ListAttacks", "shield:CreateSubscription", "shield:DescribeSubscription", "shield:GetSubscriptionState", "shield:DescribeDRTAccess", "shield:DescribeEmergencyContactSettings", "shield:UpdateEmergencyContactSettings", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeAddresses", "shield:EnableApplicationLayerAutomaticResponse", "shield:DisableApplicationLayerAutomaticResponse", "shield:UpdateApplicationLayerAutomaticResponse" ], "Resource": "*" }, { "Sid": "EC2SecurityGroupScoped", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SecurityGroupTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "SecurityGroupTagManagement", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringLike": { "aws:ResourceTag/FMManaged": "*" } } }, { "Sid": "Ec2Unscoped", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:AssociateRouteTable", "ec2:CreateSubnet", "ec2:CreateRouteTable", "ec2:DeleteSubnet", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation" ], "Resource": [ "*" ] }, { "Sid": "Wafv2General", "Effect": "Allow", "Action": [ "wafv2:TagResource", "wafv2:ListResourcesForWebACL", "wafv2:AssociateWebACL", "wafv2:ListTagsForResource", "wafv2:UntagResource", "wafv2:GetWebACL", "wafv2:DisassociateFirewallManager", "wafv2:DeleteWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "Wafv2WebAclAndRuleGroupMutation", "Effect": "Allow", "Action": [ "wafv2:UpdateWebACL", "wafv2:CreateWebACL", "wafv2:DeleteFirewallManagerRuleGroups", "wafv2:PutFirewallManagerRuleGroups" ], "Resource": [ "arn:aws:wafv2:*:*:global/webacl/*", "arn:aws:wafv2:*:*:regional/webacl/*", "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*", "arn:aws:wafv2:*:*:global/managedruleset/*", "arn:aws:wafv2:*:*:regional/managedruleset/*", "arn:aws:wafv2:*:*:global/ipset/*", "arn:aws:wafv2:*:*:regional/ipset/*", "arn:aws:wafv2:*:*:global/regexpatternset/*", "arn:aws:wafv2:*:*:regional/regexpatternset/*" ] }, { "Sid": "Wafv2PermissionPolicy", "Effect": "Allow", "Action": [ "wafv2:PutPermissionPolicy", "wafv2:GetPermissionPolicy", "wafv2:DeletePermissionPolicy" ], "Resource": [ "arn:aws:wafv2:*:*:global/rulegroup/*", "arn:aws:wafv2:*:*:regional/rulegroup/*" ] }, { "Sid": "Wafv2WebaclDescribe", "Effect": "Allow", "Action": [ "wafv2:GetWebACLForResource" ], "Resource": [ "arn:aws:wafv2:*:*:regional/webacl/*" ] }, { "Sid": "RouteTableTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "SubnetTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "VPCEndpointTagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RouteTableCleanup", "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "Ec2DescribeUnscoped", "Effect": "Allow", "Action": [ "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "CreateVpcEndpointScoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "CreateVpcEndpointUnscoped", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "VpcEndpointsDeletion", "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamTagManagement", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": [ "arn:aws:ram:*:*:resource-share/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "RamMutation", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "arn:aws:ram:*:*:resource-share/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "RamCreation", "Effect": "Allow", "Action": "ram:CreateResourceShare", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] }, "StringEquals": { "aws:RequestTag/FMManaged": [ "true" ] } } }, { "Sid": "RamDescribe", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "SlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "network-firewall.amazonaws.com", "shield.amazonaws.com" ] } } }, { "Sid": "IamDescribe", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "*" }, { "Sid": "NetworkFirewallTagManagement", "Effect": "Allow", "Action": [ "network-firewall:TagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged" ] } } }, { "Sid": "NetworkFirewallGeneral", "Effect": "Allow", "Action": [ "network-firewall:AssociateSubnets", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:DisassociateSubnets", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:UpdateFirewallPolicy", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "network-firewall:DescribeResourcePolicy", "network-firewall:DeleteResourcePolicy", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateLoggingConfiguration", "network-firewall:DescribeTLSInspectionConfiguration", "network-firewall:ListTLSInspectionConfigurations" ], "Resource": "*" }, { "Sid": "NetworkFirewallResourcePolicy", "Effect": "Allow", "Action": [ "network-firewall:PutResourcePolicy" ], "Resource": [ "arn:aws:network-firewall:*:*:firewall-policy/*", "arn:aws:network-firewall:*:*:stateful-rulegroup/*", "arn:aws:network-firewall:*:*:stateless-rulegroup/*" ] }, { "Sid": "NetworkFirewallCleanup", "Effect": "Allow", "Action": [ "network-firewall:DeleteFirewallPolicy", "network-firewall:DeleteFirewall" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "LogsGeneral", "Effect": "Allow", "Action": [ "logs:ListLogDeliveries", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupUnscoped", "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListTagsForResource", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupPolicy", "route53resolver:PutFirewallRuleGroupPolicy" ], "Resource": "*" }, { "Sid": "Route53ResolverRuleGroupCleanup", "Effect": "Allow", "Action": [ "route53resolver:UpdateFirewallRuleGroupAssociation", "route53resolver:DisassociateFirewallRuleGroup" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "Route53ResolverRuleGroupScoped", "Effect": "Allow", "Action": [ "route53resolver:AssociateFirewallRuleGroup", "route53resolver:TagResource" ], "Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*", "Condition": { "StringEquals": { "aws:RequestTag/FMManaged": "true" } } }, { "Sid": "NaclTagCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl" } } }, { "Sid": "NaclTagManagement", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "Name", "FMManaged", "FMPolicies" ] }, "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclScoped", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkAclEntry", "ec2:CreateNetworkAclEntry", "ec2:ReplaceNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } } }, { "Sid": "NaclUnscoped", "Effect": "Allow", "Action": [ "ec2:ReplaceNetworkAclAssociation", "ec2:DescribeNetworkAcls", "ec2:CreateNetworkAcl" ], "Resource": "*" } ] } } }, "createdDate": "2018-03-28T23:01:12.000Z", "lastUpdatedDate": "2025-02-11T21:37:06.000Z" }, "AmazonTranscribeReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTranscribeReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-04-04T16:05:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "transcribe:Get*", "transcribe:List*" ], "Resource": "*" } ] } } }, "createdDate": "2018-04-04T16:05:06.000Z", "lastUpdatedDate": "2018-04-04T16:05:06.000Z" }, "AmazonTranscribeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-04-04T16:06:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "transcribe:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*transcribe*" ] } ] } } }, "createdDate": "2018-04-04T16:06:16.000Z", "lastUpdatedDate": "2018-04-04T16:06:16.000Z" }, "SecretsManagerReadWrite": { "arn": "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2018-04-04T18:05:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBInstances", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:SecretsManager*" }, { "Action": [ "serverlessrepo:CreateCloudFormationChangeSet" ], "Effect": "Allow", "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*" }, { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::awsserverlessrepo-changesets*" } ] } }, "v2": { "createdDate": "2018-05-03T20:02:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:SecretsManager*" }, { "Action": [ "serverlessrepo:CreateCloudFormationChangeSet" ], "Effect": "Allow", "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*" }, { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::awsserverlessrepo-changesets*" } ] } }, "v3": { "createdDate": "2020-06-24T18:01:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "redshift:DescribeClusters", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:SecretsManager*" }, { "Action": [ "serverlessrepo:CreateCloudFormationChangeSet", "serverlessrepo:GetApplication" ], "Effect": "Allow", "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*" }, { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*" ] } ] } }, "v4": { "createdDate": "2018-04-04T18:05:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "docdb-elastic:GetCluster", "docdb-elastic:ListClusters", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "redshift:DescribeClusters", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": "arn:aws:lambda:*:*:function:SecretsManager*" }, { "Effect": "Allow", "Action": [ "serverlessrepo:CreateCloudFormationChangeSet", "serverlessrepo:GetApplication" ], "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*" ] } ] } }, "v5": { "createdDate": "2018-04-04T18:05:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BasePermissions", "Effect": "Allow", "Action": [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "docdb-elastic:GetCluster", "docdb-elastic:ListClusters", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "tag:GetResources" ], "Resource": "*" }, { "Sid": "LambdaPermissions", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": "arn:aws:lambda:*:*:function:SecretsManager*" }, { "Sid": "SARPermissions", "Effect": "Allow", "Action": [ "serverlessrepo:CreateCloudFormationChangeSet", "serverlessrepo:GetApplication" ], "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*" }, { "Sid": "S3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*" ] } ] } } }, "createdDate": "2018-04-04T18:05:29.000Z", "lastUpdatedDate": "2024-02-22T18:12:06.000Z" }, "AWSAppSyncPushToCloudWatchLogs": { "arn": "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-04-09T19:38:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2018-04-09T19:38:55.000Z", "lastUpdatedDate": "2018-04-09T19:38:55.000Z" }, "AWSArtifactAccountSync": { "arn": "arn:aws:iam::aws:policy/service-role/AWSArtifactAccountSync", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-04-10T23:04:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2018-04-10T23:04:33.000Z", "lastUpdatedDate": "2018-04-10T23:04:33.000Z" }, "AmazonElasticTranscoder_FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticTranscoder_FullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-04-27T18:59:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListObjects", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "elastictranscoder.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2019-06-10T22:51:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:*", "s3:ListAllMyBuckets", "s3:ListBucket", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "elastictranscoder.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-04-27T18:59:35.000Z", "lastUpdatedDate": "2019-06-10T22:51:51.000Z" }, "AmazonRDSBetaServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSBetaServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2018-05-02T19:41:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v2": { "createdDate": "2018-05-08T22:28:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v3": { "createdDate": "2018-07-05T18:29:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v4": { "createdDate": "2020-07-28T19:26:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v5": { "createdDate": "2020-11-18T22:40:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v6": { "createdDate": "2022-02-22T20:46:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS" ] } } } ] } }, "v7": { "createdDate": "2022-06-07T17:10:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } } ] } }, "v8": { "createdDate": "2022-12-14T18:33:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds-beta-us-east-1!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-beta-us-east-1" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds-beta-us-east-1!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-beta-us-east-1" } } } ] } }, "v9": { "createdDate": "2018-05-02T19:41:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVpcEndpoint", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds-beta-us-east-1!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-beta-us-east-1" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds-beta-us-east-1!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-beta-us-east-1" } } } ] } } }, "createdDate": "2018-05-02T19:41:04.000Z", "lastUpdatedDate": "2024-08-07T00:54:21.000Z" }, "AWSFMAdminFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSFMAdminFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-05-09T18:06:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "fms:*", "waf:*", "waf-regional:*", "elasticloadbalancing:SetWebACL", "organizations:DescribeOrganization" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-10-20T23:39:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "fms:*", "waf:*", "waf-regional:*", "elasticloadbalancing:SetWebACL", "firehose:ListDeliveryStreams", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "shield:GetSubscriptionState", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListAvailableManagedRuleGroups", "wafv2:CheckCapacity", "wafv2:PutLoggingConfiguration", "wafv2:ListAvailableManagedRuleGroupVersions", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListRuleGroups", "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fms.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:ListDelegatedAdministrators", "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "fms.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-05-09T18:06:18.000Z", "lastUpdatedDate": "2022-10-20T23:39:06.000Z" }, "AWSFMAdminReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSFMAdminReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-05-09T20:07:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "fms:Get*", "fms:List*", "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "organizations:DescribeOrganization" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-10-31T22:42:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "fms:Get*", "fms:List*", "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "firehose:ListDeliveryStreams", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "shield:GetSubscriptionState", "route53resolver:ListFirewallRuleGroups", "route53resolver:GetFirewallRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListAvailableManagedRuleGroups", "wafv2:CheckCapacity", "wafv2:ListAvailableManagedRuleGroupVersions", "network-firewall:DescribeRuleGroup", "network-firewall:DescribeRuleGroupMetadata", "network-firewall:ListRuleGroups", "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ] }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "fms.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-05-09T20:07:39.000Z", "lastUpdatedDate": "2022-10-31T22:42:13.000Z" }, "AWSFMMemberReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSFMMemberReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-05-09T21:05:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "fms:GetAdminAccount", "waf:Get*", "waf:List*", "waf-regional:Get*", "waf-regional:List*", "organizations:DescribeOrganization" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-05-09T21:05:29.000Z", "lastUpdatedDate": "2018-05-09T21:05:29.000Z" }, "AWSIoT1ClickReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoT1ClickReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-05-11T21:49:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iot1click:Describe*", "iot1click:Get*", "iot1click:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-05-11T21:49:24.000Z", "lastUpdatedDate": "2018-05-11T21:49:24.000Z" }, "AWSIoT1ClickFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoT1ClickFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-05-11T22:10:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iot1click:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-05-11T22:10:14.000Z", "lastUpdatedDate": "2018-05-11T22:10:14.000Z" }, "AmazonEKSClusterPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-05-27T21:06:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-10-03T20:56:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2019-05-22T22:04:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-02-21T20:10:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2021-06-15T20:57:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2023-02-07T17:33:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2018-05-27T21:06:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:UpdateAutoScalingGroup", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateRoute", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteRoute", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DetachVolume", "ec2:ModifyInstanceAttribute", "ec2:ModifyVolume", "ec2:RevokeSecurityGroupIngress", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeInstanceTopology", "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } } }, "createdDate": "2018-05-27T21:06:14.000Z", "lastUpdatedDate": "2024-11-01T17:39:00.000Z" }, "AmazonEKS_CNI_Policy": { "arn": "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v3": { "createdDate": "2019-06-27T18:10:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v2": { "createdDate": "2018-05-31T22:16:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v1": { "createdDate": "2018-05-27T21:07:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:::network-interface/*" ] } ] } }, "v4": { "createdDate": "2020-04-20T20:52:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v5": { "createdDate": "2018-05-27T21:07:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonEKSCNIPolicy", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": "*" }, { "Sid": "AmazonEKSCNIPolicyENITag", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] } ] } } }, "createdDate": "2018-05-27T21:07:42.000Z", "lastUpdatedDate": "2024-03-04T20:20:55.000Z" }, "AmazonEKSServicePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-05-27T21:08:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:::vpc/*", "arn:aws:ec2:::subnet/*" ] } ] } }, "v2": { "createdDate": "2018-05-31T22:15:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] } ] } }, "v3": { "createdDate": "2019-02-26T21:01:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" } ] } }, "v4": { "createdDate": "2019-08-21T16:17:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies", "eks:UpdateClusterVersion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" } ] } }, "v6": { "createdDate": "2020-05-27T19:27:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies", "eks:UpdateClusterVersion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "eks.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-03-30T23:43:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies", "eks:UpdateClusterVersion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "eks.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2018-05-27T21:08:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListAttachedRolePolicies", "eks:UpdateClusterVersion", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "eks-cluster-*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", "Condition": { "StringLike": { "iam:AWSServiceName": "eks.amazonaws.com" } } } ] } } }, "createdDate": "2018-05-27T21:08:21.000Z", "lastUpdatedDate": "2024-10-14T21:12:40.000Z" }, "AmazonEKSWorkerNodePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2022-03-21T22:39:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "eks:DescribeCluster" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2018-05-27T21:09:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "eks:DescribeCluster" ], "Resource": "*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2018-05-27T21:09:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WorkerNodePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcs", "eks:DescribeCluster", "eks-auth:AssumeRoleForPodIdentity" ], "Resource": "*" } ] } } }, "createdDate": "2018-05-27T21:09:01.000Z", "lastUpdatedDate": "2023-11-27T00:06:13.000Z" }, "NeptuneReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/NeptuneReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-05-30T19:16:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSubnetGroups", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:ListRetirableGrants", "kms:ListAliases", "kms:ListKeyPolicies" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] } ] } }, "v2": { "createdDate": "2022-08-03T18:53:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSubnetGroups", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:ListRetirableGrants", "kms:ListAliases", "kms:ListKeyPolicies" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "neptune-db:Read*", "neptune-db:Get*", "neptune-db:List*" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-05-30T19:16:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyPermissionsForRDS", "Effect": "Allow", "Action": [ "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSubnetGroups", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForCloudwatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForEC2", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForKMS", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListRetirableGrants", "kms:ListAliases", "kms:ListKeyPolicies" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForLogs", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] }, { "Sid": "AllowReadOnlyPermissionsForNeptuneDB", "Effect": "Allow", "Action": [ "neptune-db:Read*", "neptune-db:Get*", "neptune-db:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-05-30T19:16:37.000Z", "lastUpdatedDate": "2024-01-22T16:33:46.000Z" }, "NeptuneFullAccess": { "arn": "arn:aws:iam::aws:policy/NeptuneFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-05-30T19:17:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters" ], "Resource": [ "arn:aws:rds:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-07-10T17:15:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-11-06T21:21:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "iam:PassRole", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-02-12T23:28:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-09-02T17:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": [ "graphdb", "neptune" ] } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2022-07-28T19:58:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": [ "graphdb", "neptune" ] } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterEndpoint", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:CreateGlobalCluster", "rds:DeleteDBCluster", "rds:DeleteDBClusterEndpoint", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DeleteGlobalCluster", "rds:DescribeDBClusterEndpoints", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:FailoverGlobalCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterEndpoint", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:ModifyGlobalCluster", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveFromGlobalCluster", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime", "rds:StartDBCluster", "rds:StopDBCluster" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "neptune-db:*" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2018-05-30T19:17:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowNeptuneCreate", "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": [ "graphdb", "neptune" ] } } }, { "Sid": "AllowManagementPermissionsForRDS", "Effect": "Allow", "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterEndpoint", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:CreateGlobalCluster", "rds:DeleteDBCluster", "rds:DeleteDBClusterEndpoint", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DeleteGlobalCluster", "rds:DescribeDBClusterEndpoints", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:FailoverGlobalCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterEndpoint", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:ModifyGlobalCluster", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveFromGlobalCluster", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime", "rds:StartDBCluster", "rds:StopDBCluster" ], "Resource": [ "*" ] }, { "Sid": "AllowOtherDepedentPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Resource": [ "*" ] }, { "Sid": "AllowPassRoleForNeptune", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Sid": "AllowCreateSLRForNeptune", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Sid": "AllowDataAccessForNeptune", "Effect": "Allow", "Action": [ "neptune-db:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-05-30T19:17:31.000Z", "lastUpdatedDate": "2024-01-22T16:32:31.000Z" }, "AWSConfigServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSConfigServiceRolePolicy", "latestVersionId": "v56", "versionsCount": 56, "versions": { "v3": { "createdDate": "2018-08-15T23:03:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-07-31T19:20:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-08-31T22:23:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-11-07T18:34:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2018-12-20T22:09:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-01-23T20:43:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-02-05T23:47:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2019-03-06T18:47:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "shield:DescribeProtection" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2019-03-12T18:10:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "shield:DescribeProtection" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2019-05-13T21:18:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "config:Select*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "shield:DescribeProtection" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2019-06-10T22:59:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "config:Select*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetBucketObjectLockConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "shield:DescribeProtection" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2019-06-25T23:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "ec2:Describe*", "config:Put*", "config:Get*", "config:List*", "config:Describe*", "config:BatchGet*", "config:Select*", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBClusters", "s3:GetAccelerateConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetBucketObjectLockConfiguration", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "cloudwatch:DescribeAlarms", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:GetAlias", "lambda:ListAliases", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "cloudfront:ListTagsForResource", "guardduty:ListDetectors", "guardduty:GetMasterAccount", "guardduty:GetDetector", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "kms:ListKeys", "kms:GetKeyRotationStatus", "kms:DescribeKey", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "shield:DescribeProtection" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2019-07-23T19:18:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:ListClusters", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "guardduty:GetDetector", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyRotationStatus", "kms:ListKeys", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:ListSubscriptions", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2019-08-01T23:10:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:ListClusters", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "guardduty:GetDetector", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyRotationStatus", "kms:ListKeys", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:ListSubscriptions", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v17": { "createdDate": "2019-10-21T21:54:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "support:DescribeCases", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v16": { "createdDate": "2019-09-17T17:40:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:ListClusters", "emr:ListClusters", "emr:ListInstances", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListNotebookInstances", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "support:DescribeCases", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v18": { "createdDate": "2019-11-18T22:33:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "cloudfront:ListTagsForResource", "cloudformation:describeType", "cloudformation:listTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "support:DescribeCases", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v19": { "createdDate": "2020-05-15T18:39:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:describeType", "cloudformation:listTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "eks:DescribeCluster", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "support:DescribeCases", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v20": { "createdDate": "2020-06-19T16:09:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:describeType", "cloudformation:listTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "eks:DescribeCluster", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v21": { "createdDate": "2020-12-18T22:02:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:describeType", "cloudformation:listTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "eks:DescribeCluster", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v22": { "createdDate": "2021-01-29T19:19:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:describeType", "cloudformation:listTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v23": { "createdDate": "2021-04-01T22:19:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:GetBackupPlan", "backup:ListBackupVaults", "backup:DescribeBackupVault", "backup:GetBackupVaultNotifications", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupSelections", "backup:GetBackupSelection", "backup:ListRecoveryPointsByBackupVault", "backup:DescribeRecoveryPoint", "backup:ListTags", "cloudfront:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamSummary", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v24": { "createdDate": "2021-05-11T00:14:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamSummary", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v25": { "createdDate": "2021-06-07T23:01:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v30": { "createdDate": "2022-03-11T21:29:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:ListTags", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "guardduty:ListOrganizationAdminAccounts", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v26": { "createdDate": "2021-07-27T22:31:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v29": { "createdDate": "2022-02-10T18:34:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v27": { "createdDate": "2021-09-08T18:12:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "es:DescribeDomain", "es:DescribeDomains", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBParameters", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v31": { "createdDate": "2022-04-06T21:41:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "guardduty:ListOrganizationAdminAccounts", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v28": { "createdDate": "2022-01-21T18:35:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "es:DescribeDomain", "es:DescribeDomains", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBParameters", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v32": { "createdDate": "2022-05-31T18:25:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListTagsForResource", "detective:ListGraphs", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:ListConfigurationSets", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v34": { "createdDate": "2022-08-19T22:19:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ExportThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListBillingGroups", "billingconductor:ListAccountAssociations", "billingconductor:ListTagsForResource", "billingconductor:ListPricingRules", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListTagsForResource", "datasync:ListLocations", "datasync:ListTasks", "datasync:ListAgents", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeArchive", "events:DescribeApiDestination", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:ListPolicies", "fms:GetPolicy", "fms:ListTagsForResource", "fms:GetNotificationChannel", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "geo:DescribeTracker", "geo:ListTrackerConsumers", "geo:DescribeGeofenceCollection", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeMap", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListInfrastructureConfigurations", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:ListTagsForResource", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListTagsForResource", "servicediscovery:ListServices", "servicediscovery:ListNamespaces", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v33": { "createdDate": "2022-07-15T01:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ExportThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListBillingGroups", "billingconductor:ListAccountAssociations", "billingconductor:ListTagsForResource", "billingconductor:ListPricingRules", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListTagsForResource", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeArchive", "events:DescribeApiDestination", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:ListPolicies", "fms:GetPolicy", "fms:ListTagsForResource", "fms:GetNotificationChannel", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "geo:DescribeTracker", "geo:ListTrackerConsumers", "geo:DescribeGeofenceCollection", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeMap", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListInfrastructureConfigurations", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:ListTagsForResource", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v35": { "createdDate": "2022-09-07T20:48:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStream", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListMaps", "geo:ListTrackerConsumers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListCertificates", "iot:ListDimensions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssets", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetInAppTemplate", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v37": { "createdDate": "2022-10-18T17:20:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v38": { "createdDate": "2022-10-31T19:27:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v36": { "createdDate": "2022-09-14T19:19:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStream", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListMaps", "geo:ListTrackerConsumers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListCertificates", "iot:ListDimensions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssets", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetInAppTemplate", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v41": { "createdDate": "2023-03-02T22:12:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appstream:DescribeDirectoryConfigs", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v42": { "createdDate": "2023-03-21T18:23:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "apprunner:DescribeService", "apprunner:ListServices", "apprunner:ListTagsForResource", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetProject", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "groundstation:GetConfig", "groundstation:ListConfigs", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApp", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v39": { "createdDate": "2023-01-05T22:27:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v40": { "createdDate": "2023-01-31T19:52:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appstream:DescribeDirectoryConfigs", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v43": { "createdDate": "2023-04-12T22:15:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:ListApps", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetProject", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "groundstation:GetConfig", "groundstation:ListConfigs", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApp", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "refactor-spaces:GetEnvironment", "refactor-spaces:ListEnvironments", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModels", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v44": { "createdDate": "2023-06-09T21:10:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v45": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:ListFilters", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:GetConnectPeer", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrCollections", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetParameter", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v46": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:ListFilters", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:GetConnectPeer", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrCollections", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v47": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeInstance", "connect:DescribePhoneNumber", "connect:DescribeQuickConnect", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListQuickConnects", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrCollections", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v48": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v49": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeMetricFilters", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v50": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v51": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "ssm-sap:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v52": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "omics:GetWorkflow", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:ListSchedules", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v53": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetWorkflow", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v54": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetWorkflow", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v55": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListTrainingDatasets", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "comprehend:DescribeFlywheel", "comprehend:ListFlywheels", "comprehend:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetAnnotationStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:ListAnnotationStores", "omics:ListRunGroups", "omics:ListSequenceStores", "omics:ListTagsForResource", "omics:ListVariantStores", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListDedicatedIpPools", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } }, "v56": { "createdDate": "2018-05-30T23:31:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigServiceRolePolicyStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListTrainingDatasets", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "comprehend:DescribeFlywheel", "comprehend:ListFlywheels", "comprehend:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetAllowedImagesSettings", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetAnnotationStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:ListAnnotationStores", "omics:ListRunGroups", "omics:ListSequenceStores", "omics:ListTagsForResource", "omics:ListVariantStores", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListDedicatedIpPools", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "AWSConfigSLRLogStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "AWSConfigSLRLogEventStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" }, { "Sid": "AWSConfigSLRApiGatewayStatementID", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes", "arn:aws:apigateway:*::/v2/apis/*/routes/*", "arn:aws:apigateway:*::/v2/apis", "arn:aws:apigateway:*::/v2/apis/*", "arn:aws:apigateway:*::/v2/apis/*/integrations", "arn:aws:apigateway:*::/v2/apis/*/integrations/*" ] } ] } } }, "createdDate": "2018-05-30T23:31:46.000Z", "lastUpdatedDate": "2025-02-27T16:07:06.000Z" }, "AmazonRDSPreviewServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSPreviewServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2018-05-31T18:02:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] } }, "v2": { "createdDate": "2020-07-29T00:05:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v3": { "createdDate": "2020-10-21T22:28:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v4": { "createdDate": "2020-11-19T19:54:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RDS" } } } ] } }, "v6": { "createdDate": "2022-06-07T16:55:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } } ] } }, "v5": { "createdDate": "2022-02-22T20:46:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS" ] } } } ] } }, "v7": { "createdDate": "2022-12-13T15:53:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB", "AWS/Neptune", "AWS/RDS", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } } ] } }, "v8": { "createdDate": "2018-05-31T18:02:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB-Preview", "AWS/Neptune-Preview", "AWS/RDS-Preview", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } } ] } }, "v9": { "createdDate": "2018-05-31T18:02:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateCoipPoolPermission", "ec2:CreateLocalGatewayRouteTablePermission", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteCoipPoolPermission", "ec2:DeleteLocalGatewayRouteTablePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB-Preview", "AWS/Neptune-Preview", "AWS/RDS-Preview", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*" ], "Condition": { "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } }, { "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:rds-preview-us-east-2!*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:rds:primaryDBInstanceArn", "aws:rds:primaryDBClusterArn" ] }, "StringLike": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "rds-preview-us-east-2" } } } ] } } }, "createdDate": "2018-05-31T18:02:00.000Z", "lastUpdatedDate": "2024-08-07T01:02:38.000Z" }, "AWSApplicationAutoScalingCustomResourcePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoScalingCustomResourcePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-06-04T23:22:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "execute-api:Invoke", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-06-04T23:22:44.000Z", "lastUpdatedDate": "2018-06-04T23:22:44.000Z" }, "AWSShieldDRTAccessPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-06-05T22:29:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "elasticloadbalancing:List*", "route53:List*", "cloudfront:Describe*", "elasticloadbalancing:Describe*", "route53:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*", "arn:aws:cloudfront::*:*", "arn:aws:route53:::hostedzone/*", "arn:aws:cloudwatch:*:*:*:*" ] }, { "Sid": "DRTManageMitigations", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Sid": "DRTManageProtections", "Effect": "Allow", "Action": [ "shield:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-11-27T04:25:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "elasticloadbalancing:List*", "route53:List*", "cloudfront:Describe*", "elasticloadbalancing:Describe*", "route53:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*", "globalaccelerator:ListAccelerators", "globalaccelerator:DescribeAccelerator" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*", "arn:aws:cloudfront::*:*", "arn:aws:route53:::hostedzone/*", "arn:aws:cloudwatch:*:*:*:*" ] }, { "Sid": "DRTManageMitigations", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Sid": "DRTManageProtections", "Effect": "Allow", "Action": [ "shield:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-02-11T17:08:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "elasticloadbalancing:List*", "route53:List*", "cloudfront:Describe*", "elasticloadbalancing:Describe*", "route53:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*", "globalaccelerator:ListAccelerators", "globalaccelerator:DescribeAccelerator" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*", "arn:aws:cloudfront::*:*", "arn:aws:route53:::hostedzone/*", "arn:aws:cloudwatch:*:*:*:*", "arn:aws:globalaccelerator::*:*" ] }, { "Sid": "DRTManageMitigations", "Effect": "Allow", "Action": [ "waf:*", "waf-regional:*" ], "Resource": [ "arn:aws:waf:*", "arn:aws:waf-regional:*" ] }, { "Sid": "DRTManageProtections", "Effect": "Allow", "Action": [ "shield:*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-03-12T19:11:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "elasticloadbalancing:List*", "route53:List*", "cloudfront:Describe*", "elasticloadbalancing:Describe*", "route53:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*", "globalaccelerator:ListAccelerators", "globalaccelerator:DescribeAccelerator" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*", "arn:aws:cloudfront::*:*", "arn:aws:route53:::hostedzone/*", "arn:aws:cloudwatch:*:*:*:*", "arn:aws:globalaccelerator::*:*" ] }, { "Sid": "DRTManageMitigations", "Effect": "Allow", "Action": [ "waf:*", "wafv2:*", "waf-regional:*" ], "Resource": [ "arn:aws:waf:*", "arn:aws:wafv2:*:*:*:*", "arn:aws:waf-regional:*" ] }, { "Sid": "DRTManageProtections", "Effect": "Allow", "Action": [ "shield:*" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-09-23T19:02:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "elasticloadbalancing:List*", "route53:List*", "cloudfront:Describe*", "elasticloadbalancing:Describe*", "route53:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*", "globalaccelerator:ListAccelerators", "globalaccelerator:DescribeAccelerator" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:*", "arn:aws:cloudfront::*:*", "arn:aws:route53:::hostedzone/*", "arn:aws:cloudwatch:*:*:*:*", "arn:aws:globalaccelerator::*:*" ] }, { "Sid": "DRTManageMitigations", "Effect": "Allow", "Action": [ "waf:*", "wafv2:*", "waf-regional:*", "elasticloadbalancing:SetWebACL", "apigateway:SetWebACL", "cloudfront:UpdateDistribution" ], "Resource": "*" }, { "Sid": "DRTManageProtections", "Effect": "Allow", "Action": [ "shield:*" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-12-15T17:28:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SRTAccessProtectedResources", "Effect": "Allow", "Action": [ "cloudfront:List*", "route53:List*", "elasticloadbalancing:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudfront:GetDistribution*", "globalaccelerator:ListAccelerators", "globalaccelerator:DescribeAccelerator", "ec2:DescribeRegions", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "SRTManageProtections", "Effect": "Allow", "Action": [ "shield:*", "waf:*", "wafv2:*", "waf-regional:*", "elasticloadbalancing:SetWebACL", "cloudfront:UpdateDistribution", "apigateway:SetWebACL" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-05T22:29:39.000Z", "lastUpdatedDate": "2020-12-15T17:28:15.000Z" }, "AmazonElasticTranscoder_ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticTranscoder_ReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2019-06-10T22:48:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:Read*", "elastictranscoder:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2018-06-07T21:09:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:Read*", "elastictranscoder:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListObjects", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-06-07T21:09:56.000Z", "lastUpdatedDate": "2019-06-10T22:48:32.000Z" }, "AmazonElasticTranscoder_JobsSubmitter": { "arn": "arn:aws:iam::aws:policy/AmazonElasticTranscoder_JobsSubmitter", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-06-07T21:12:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:Read*", "elastictranscoder:List*", "elastictranscoder:*Job", "elastictranscoder:*Preset", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListObjects", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-10T22:49:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elastictranscoder:Read*", "elastictranscoder:List*", "elastictranscoder:*Job", "elastictranscoder:*Preset", "s3:ListAllMyBuckets", "s3:ListBucket", "iam:ListRoles", "sns:ListTopics" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-06-07T21:12:16.000Z", "lastUpdatedDate": "2019-06-10T22:49:34.000Z" }, "AWSCloudFrontLogger": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSCloudFrontLogger", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-06-12T20:15:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:/aws/cloudfront/*" } ] } }, "v2": { "createdDate": "2019-11-22T19:33:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cloudfront/*" } ] } } }, "createdDate": "2018-06-12T20:15:23.000Z", "lastUpdatedDate": "2019-11-22T19:33:51.000Z" }, "AWSLambdaSQSQueueExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-06-14T21:50:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-14T21:50:45.000Z", "lastUpdatedDate": "2018-06-14T21:50:45.000Z" }, "AWSIoTAnalyticsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTAnalyticsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-06-18T21:37:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotanalytics:Describe*", "iotanalytics:List*", "iotanalytics:Get*", "iotanalytics:SampleChannelData" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-18T21:37:49.000Z", "lastUpdatedDate": "2018-06-18T21:37:49.000Z" }, "AWSIoTAnalyticsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTAnalyticsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-06-18T23:02:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotanalytics:*" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-18T23:02:45.000Z", "lastUpdatedDate": "2018-06-18T23:02:45.000Z" }, "NeptuneConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/NeptuneConsoleFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2018-06-19T21:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-01-23T20:49:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "iam:ListRoles", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-11-06T21:19:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "graphdb" } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "iam:ListRoles", "iam:PassRole", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-09-02T17:25:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": [ "graphdb", "neptune" ] } } }, { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "iam:ListRoles", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2018-06-19T21:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowNeptuneCreate", "Effect": "Allow", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance" ], "Resource": [ "arn:aws:rds:*:*:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": [ "graphdb", "neptune" ] } } }, { "Sid": "AllowManagementPermissionsForRDS", "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Sid": "AllowOtherDepedentPermissions", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "iam:ListRoles", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Sid": "AllowPassRoleForNeptune", "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "rds.amazonaws.com" } } }, { "Sid": "AllowCreateSLRForNeptune", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Sid": "AllowManagementPermissionsForNeptuneAnalytics", "Effect": "Allow", "Action": [ "neptune-graph:CreateGraph", "neptune-graph:DeleteGraph", "neptune-graph:GetGraph", "neptune-graph:ListGraphs", "neptune-graph:UpdateGraph", "neptune-graph:ResetGraph", "neptune-graph:CreateGraphSnapshot", "neptune-graph:DeleteGraphSnapshot", "neptune-graph:GetGraphSnapshot", "neptune-graph:ListGraphSnapshots", "neptune-graph:RestoreGraphFromSnapshot", "neptune-graph:CreatePrivateGraphEndpoint", "neptune-graph:GetPrivateGraphEndpoint", "neptune-graph:ListPrivateGraphEndpoints", "neptune-graph:DeletePrivateGraphEndpoint", "neptune-graph:CreateGraphUsingImportTask", "neptune-graph:GetImportTask", "neptune-graph:ListImportTasks", "neptune-graph:CancelImportTask" ], "Resource": [ "arn:aws:neptune-graph:*:*:*" ] }, { "Sid": "AllowPassRoleForNeptuneAnalytics", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:passedToService": "neptune-graph.amazonaws.com" } } }, { "Sid": "AllowCreateSLRForNeptuneAnalytics", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/neptune-graph.amazonaws.com/AWSServiceRoleForNeptuneGraph", "Condition": { "StringLike": { "iam:AWSServiceName": "neptune-graph.amazonaws.com" } } } ] } } }, "createdDate": "2018-06-19T21:35:19.000Z", "lastUpdatedDate": "2023-11-30T07:32:44.000Z" }, "AmazonMacieServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonMacieServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-06-19T22:17:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "iam:ListAccountAliases", "s3:Get*", "s3:List*" ] }, { "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/AWSMacieTrail-DO-NOT-EDIT", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:DeleteTrail", "cloudtrail:PutEventSelectors" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsmacie-*", "arn:aws:s3:::awsmacietrail-*", "arn:aws:s3:::*-awsmacietrail-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:DeleteReplicationConfiguration", "s3:PutBucketPolicy" ] } ] } }, "v2": { "createdDate": "2019-09-27T21:50:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "iam:ListAccountAliases", "s3:Get*", "s3:List*" ] }, { "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/AWSMacieTrail-DO-NOT-EDIT", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:DeleteTrail", "cloudtrail:PutEventSelectors" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsmacie-*", "arn:aws:s3:::awsmacietrail-*", "arn:aws:s3:::*-awsmacietrail-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:PutBucketPolicy" ] } ] } }, "v3": { "createdDate": "2020-04-30T17:41:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "iam:ListAccountAliases", "s3:Get*", "s3:List*", "organizations:DescribeAccount", "organizations:ListAccounts" ] }, { "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/AWSMacieTrail-DO-NOT-EDIT", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:DeleteTrail", "cloudtrail:PutEventSelectors" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsmacie-*", "arn:aws:s3:::awsmacietrail-*", "arn:aws:s3:::*-awsmacietrail-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:PutBucketPolicy" ] } ] } }, "v4": { "createdDate": "2020-07-17T21:31:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "iam:ListAccountAliases", "organizations:DescribeAccount", "organizations:ListAccounts", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListBucket", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging" ] }, { "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/AWSMacieTrail-DO-NOT-EDIT", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:DeleteTrail", "cloudtrail:PutEventSelectors" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsmacie-*", "arn:aws:s3:::awsmacietrail-*", "arn:aws:s3:::*-awsmacietrail-*" ], "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:PutBucketPolicy" ] } ] } }, "v5": { "createdDate": "2021-04-13T17:55:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudtrail:LookupEvents", "iam:ListAccountAliases", "organizations:DescribeAccount", "organizations:ListAccounts", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListBucket", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:DeleteTrail", "cloudtrail:PutEventSelectors" ], "Resource": "arn:aws:cloudtrail:*:*:trail/AWSMacieTrail-DO-NOT-EDIT" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::awsmacie-*", "arn:aws:s3:::awsmacietrail-*", "arn:aws:s3:::*-awsmacietrail-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/macie/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/macie/*:log-stream:*" ] } ] } }, "v6": { "createdDate": "2022-05-19T19:16:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ListAccountAliases", "organizations:DescribeAccount", "organizations:ListAccounts", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListBucket", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/macie/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/macie/*:log-stream:*" ] } ] } } }, "createdDate": "2018-06-19T22:17:38.000Z", "lastUpdatedDate": "2022-05-19T19:16:56.000Z" }, "AWSElementalMediaConvertReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaConvertReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-06-25T19:25:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconvert:Get*", "mediaconvert:List*", "mediaconvert:DescribeEndpoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListObjects" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-10T22:52:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconvert:Get*", "mediaconvert:List*", "mediaconvert:DescribeEndpoints", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-25T19:25:14.000Z", "lastUpdatedDate": "2019-06-10T22:52:18.000Z" }, "AWSElementalMediaConvertFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaConvertFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-06-25T19:25:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconvert:*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListObjects" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "mediaconvert.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2019-06-10T22:52:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconvert:*", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "mediaconvert.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-06-25T19:25:35.000Z", "lastUpdatedDate": "2019-06-10T22:52:25.000Z" }, "AWSSSOReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSSSOReadOnly", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2018-06-27T20:24:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:DescribePermissionsPolicies", "sso:GetApplicationTemplate", "sso:GetApplicationInstance", "sso:GetPermissionSet", "sso:GetProfile", "sso:GetPermissionsPolicy", "sso:GetSSOStatus", "sso:GetTrust", "sso:ListPermissionSets", "sso:ListDirectoryAssociations", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:ListApplicationInstanceCertificates", "sso:ListApplicationTemplates", "sso:ListApplications", "sso:ListProfileAssociations", "sso:Search*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-10-17T20:44:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:DescribePermissionsPolicies", "sso:GetApplicationTemplate", "sso:GetApplicationInstance", "sso:GetPermissionSet", "sso:GetProfile", "sso:GetPermissionsPolicy", "sso:GetSSOStatus", "sso:GetTrust", "sso:ListPermissionSets", "sso:ListDirectoryAssociations", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:ListApplicationInstanceCertificates", "sso:ListApplicationTemplates", "sso:ListApplications", "sso:ListProfileAssociations", "sso:Search*", "sso-directory:DescribeDirectory" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-12-19T20:17:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:DescribePermissionsPolicies", "sso:GetApplicationTemplate", "sso:GetApplicationInstance", "sso:GetPermissionSet", "sso:GetProfile", "sso:GetPermissionsPolicy", "sso:GetSSOStatus", "sso:GetSSOConfiguration", "sso:GetTrust", "sso:ListPermissionSets", "sso:ListDirectoryAssociations", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:ListApplicationInstanceCertificates", "sso:ListApplicationTemplates", "sso:ListApplications", "sso:ListProfileAssociations", "sso:Search*", "sso-directory:DescribeDirectory" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-10-24T15:45:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:DescribePermissionsPolicies", "sso:GetApplicationTemplate", "sso:GetApplicationInstance", "sso:GetPermissionSet", "sso:GetProfile", "sso:GetPermissionsPolicy", "sso:GetSSOStatus", "sso:GetSSOConfiguration", "sso:GetTrust", "sso:ListPermissionSets", "sso:ListDirectoryAssociations", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:ListApplicationInstanceCertificates", "sso:ListApplicationTemplates", "sso:ListApplications", "sso:ListProfileAssociations", "sso:Search*", "sso:GetMfaDeviceManagementForDirectory", "sso-directory:DescribeDirectory" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-04-28T21:17:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:DescribePermissionsPolicies", "sso:DescribeRegisteredRegions", "sso:GetApplicationTemplate", "sso:GetApplicationInstance", "sso:GetPermissionSet", "sso:GetProfile", "sso:GetPermissionsPolicy", "sso:GetSSOStatus", "sso:GetSSOConfiguration", "sso:GetSharedSsoConfiguration", "sso:GetManagedApplicationInstance", "sso:GetTrust", "sso:ListPermissionSets", "sso:ListDirectoryAssociations", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:ListApplicationInstanceCertificates", "sso:ListApplicationTemplates", "sso:ListApplications", "sso:ListProfileAssociations", "sso:Search*", "sso:GetMfaDeviceManagementForDirectory", "sso-directory:DescribeDirectory" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-09-10T21:26:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "sso-directory:DescribeDirectory" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-04-28T18:46:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "sso-directory:DescribeDirectory", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2022-08-22T17:23:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedAdministrators", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "sso-directory:DescribeDirectory", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2018-06-27T20:24:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOReadOnly", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedAdministrators", "sso:Describe*", "sso:Get*", "sso:List*", "sso:Search*", "sso-directory:DescribeDirectory", "access-analyzer:ValidatePolicy", "signin:ListTrustedIdentityPropagationApplicationsForConsole" ], "Resource": "*" } ] } } }, "createdDate": "2018-06-27T20:24:34.000Z", "lastUpdatedDate": "2024-04-26T00:44:59.000Z" }, "AWSSSOMasterAccountAdministrator": { "arn": "arn:aws:iam::aws:policy/AWSSSOMasterAccountAdministrator", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2018-06-27T20:36:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam:::role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-07-03T20:10:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-10-17T20:41:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*", "sso-directory:DescribeDirectory", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-08-04T21:10:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*", "sso-directory:*", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-03-25T18:53:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-04-28T18:38:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-08-22T17:07:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2022-10-20T20:34:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "identitystore-auth:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2018-06-27T20:36:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "identitystore-auth:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy", "signin:CreateTrustedIdentityPropagationApplicationForConsole", "signin:ListTrustedIdentityPropagationApplicationsForConsole" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } }, "v10": { "createdDate": "2018-06-27T20:36:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:AWSServiceName": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMasterAccountAdministrator", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", "Condition": { "StringLike": { "iam:PassedToService": "sso.amazonaws.com" } } }, { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeTrusts", "ds:UnauthorizeApplication", "ds:DescribeDirectories", "ds:AuthorizeApplication", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "identitystore-auth:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy", "signin:CreateTrustedIdentityPropagationApplicationForConsole", "signin:ListTrustedIdentityPropagationApplicationsForConsole" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } }, { "Sid": "AllowDeleteSyncProfile", "Effect": "Allow", "Action": [ "identity-sync:DeleteSyncProfile" ], "Resource": [ "arn:aws:identity-sync:*:*:profile/*" ] } ] } } }, "createdDate": "2018-06-27T20:36:51.000Z", "lastUpdatedDate": "2024-09-26T17:13:59.000Z" }, "AWSSSOMemberAccountAdministrator": { "arn": "arn:aws:iam::aws:policy/AWSSSOMemberAccountAdministrator", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2018-06-27T20:45:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "sso:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-10-17T20:35:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "sso:*", "sso-directory:DescribeDirectory", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-08-04T20:13:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "sso:*", "sso-directory:*", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-03-25T20:11:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-04-28T18:53:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-08-22T17:18:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2022-10-20T20:32:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "identitystore-auth:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2018-06-27T20:45:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSOMemberAccountAdministrator", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ds:DescribeTrusts", "iam:ListPolicies", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedAdministrators", "sso:*", "sso-directory:*", "identitystore:*", "identitystore-auth:*", "ds:CreateAlias", "access-analyzer:ValidatePolicy", "signin:CreateTrustedIdentityPropagationApplicationForConsole", "signin:ListTrustedIdentityPropagationApplicationsForConsole" ], "Resource": "*" }, { "Sid": "AWSSSOManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "sso.amazonaws.com" } } } ] } } }, "createdDate": "2018-06-27T20:45:42.000Z", "lastUpdatedDate": "2024-04-26T00:31:10.000Z" }, "AmazonMacieHandshakeRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonMacieHandshakeRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-06-28T15:46:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "iam:AWSServiceName": "macie.amazonaws.com" } } } ] } } }, "createdDate": "2018-06-28T15:46:10.000Z", "lastUpdatedDate": "2018-06-28T15:46:10.000Z" }, "AWSDataLifecycleManagerServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2018-07-06T19:34:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" } ] } }, "v2": { "createdDate": "2019-05-29T16:44:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" } ] } }, "v3": { "createdDate": "2019-11-20T19:27:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" } ] } }, "v5": { "createdDate": "2020-09-09T18:52:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores", "ec2:CopySnapshot", "ec2:ModifySnapshotAttribute", "ec2:DescribeSnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" } ] } }, "v4": { "createdDate": "2019-12-19T19:42:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores", "ec2:CopySnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" } ] } }, "v6": { "createdDate": "2020-12-11T18:15:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores", "ec2:CopySnapshot", "ec2:ModifySnapshotAttribute", "ec2:DescribeSnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AwsDataLifecycleRule.managed-cwe.*" } ] } }, "v7": { "createdDate": "2022-09-19T17:34:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores", "ec2:CopySnapshot", "ec2:ModifySnapshotAttribute", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshotTierStatus", "ec2:ModifySnapshotTier" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AwsDataLifecycleRule.managed-cwe.*" } ] } }, "v8": { "createdDate": "2018-07-06T19:34:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:EnableFastSnapshotRestores", "ec2:DescribeFastSnapshotRestores", "ec2:DisableFastSnapshotRestores", "ec2:CopySnapshot", "ec2:ModifySnapshotAttribute", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshotTierStatus", "ec2:ModifySnapshotTier", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AwsDataLifecycleRule.managed-cwe.*" } ] } } }, "createdDate": "2018-07-06T19:34:16.000Z", "lastUpdatedDate": "2024-12-16T17:37:06.000Z" }, "AWSIoTDeviceDefenderAudit": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-07-18T21:17:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:GetLoggingOptions", "iot:GetV2LoggingOptions", "iot:ListCACertificates", "iot:ListCertificates", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:ListPolicies", "iot:GetPolicy", "iot:GetEffectivePolicies", "cognito-identity:GetIdentityPoolRoles", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-11-25T23:52:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:GetLoggingOptions", "iot:GetV2LoggingOptions", "iot:ListCACertificates", "iot:ListCertificates", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:ListPolicies", "iot:GetPolicy", "iot:GetEffectivePolicies", "iot:ListRoleAliases", "iot:DescribeRoleAlias", "cognito-identity:GetIdentityPoolRoles", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies", "iam:GetRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-11-25T19:10:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:GetLoggingOptions", "iot:GetV2LoggingOptions", "iot:ListCACertificates", "iot:ListCertificates", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:ListPolicies", "iot:GetPolicy", "iot:GetEffectivePolicies", "iot:ListRoleAliases", "iot:DescribeRoleAlias", "cognito-identity:GetIdentityPoolRoles", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-07-18T21:17:40.000Z", "lastUpdatedDate": "2019-11-25T23:52:43.000Z" }, "AWSMarketplaceImageBuildFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-07-31T23:29:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:StartBuild", "aws-marketplace:DescribeBuilds" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/marketplace-image-build:build-id": "*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*Automation*", "arn:aws:iam::*:role/*Instance*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:CreateDocument", "ssm:StartAutomationExecution", "ssm:ListDocuments", "ssm:UpdateDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:DescribeDocument", "ec2:DeregisterImage", "ec2:CopyImage", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DeleteSnapshot", "sns:GetTopicAttributes", "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*image-build*" ] } ] } }, "v2": { "createdDate": "2018-08-08T21:11:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:StartBuild", "aws-marketplace:DescribeBuilds" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/marketplace-image-build:build-id": "*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*Automation*", "arn:aws:iam::*:role/*Instance*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:CreateDocument", "ssm:StartAutomationExecution", "ssm:ListDocuments", "ssm:UpdateDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:DescribeDocument", "ec2:DeregisterImage", "ec2:CopyImage", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DeleteSnapshot", "ec2:CreateImage", "ec2:RunInstances", "ec2:DescribeInstanceStatus", "sns:GetTopicAttributes", "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*image-build*" ] } ] } }, "v3": { "createdDate": "2022-03-04T17:05:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListBuilds", "aws-marketplace:StartBuild", "aws-marketplace:DescribeBuilds" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/marketplace-image-build:build-id": "*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*Automation*", "arn:aws:iam::*:role/*Instance*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:DescribeDocument", "ec2:DeregisterImage", "ec2:CopyImage", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DeleteSnapshot", "ec2:CreateImage", "ec2:RunInstances", "ec2:DescribeInstanceStatus", "sns:GetTopicAttributes", "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*image-build*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*image-build*" ] }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*", "arn:aws:ssm:us-east-1:058657716661:automation-definition/*", "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*", "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*", "arn:aws:ssm:us-west-2:243045473901:automation-definition/*", "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*", "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*", "arn:aws:ssm:us-east-2:134937423163:automation-definition/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ssm.amazonaws.com" ], "iam:AssociatedResourceARN": [ "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*", "arn:aws:ssm:us-east-1:058657716661:automation-definition/*", "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*", "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*", "arn:aws:ssm:us-west-2:243045473901:automation-definition/*", "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*", "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*", "arn:aws:ssm:us-east-2:134937423163:automation-definition/*" ] } } }, { "Effect": "Deny", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:RequestTag/marketplace-image-build:build-id": "*" }, "StringNotEquals": { "ec2:CreateAction": "RunInstances" } } } ] } } }, "createdDate": "2018-07-31T23:29:49.000Z", "lastUpdatedDate": "2022-03-04T17:05:09.000Z" }, "AWSDiscoveryContinuousExportFirehosePolicy": { "arn": "arn:aws:iam::aws:policy/AWSDiscoveryContinuousExportFirehosePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-06-08T17:32:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetTableVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-application-discovery-service-*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/application-discovery-service/firehose:log-stream:*" ] } ] } }, "v1": { "createdDate": "2018-08-09T18:29:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetTableVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-application-discovery-service-*", "arn:aws:s3:::aws-application-discovery-service-*/*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/application-discovery-service/firehose:log-stream:*" ] } ] } } }, "createdDate": "2018-08-09T18:29:39.000Z", "lastUpdatedDate": "2021-06-08T17:32:46.000Z" }, "ApplicationDiscoveryServiceContinuousExportServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ApplicationDiscoveryServiceContinuousExportServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-08-09T20:22:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "glue:CreateDatabase", "glue:UpdateDatabase", "glue:CreateTable", "glue:UpdateTable", "firehose:CreateDeliveryStream", "firehose:DescribeDeliveryStream", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "firehose:DeleteDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch", "firehose:UpdateDestination" ], "Effect": "Allow", "Resource": "arn:aws:firehose:*:*:deliverystream/aws-application-discovery-service*" }, { "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:s3:::aws-application-discovery-service*" }, { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::aws-application-discovery-service*/*" }, { "Action": [ "logs:CreateLogStream", "logs:PutRetentionPolicy" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/application-discovery-service/firehose*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSApplicationDiscoveryServiceFirehose", "Condition": { "StringLike": { "iam:PassedToService": "firehose.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-08-13T22:31:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "glue:CreateDatabase", "glue:UpdateDatabase", "glue:CreateTable", "glue:UpdateTable", "firehose:CreateDeliveryStream", "firehose:DescribeDeliveryStream", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "firehose:DeleteDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch", "firehose:UpdateDestination" ], "Effect": "Allow", "Resource": "arn:aws:firehose:*:*:deliverystream/aws-application-discovery-service*" }, { "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:s3:::aws-application-discovery-service*" }, { "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::aws-application-discovery-service*/*" }, { "Action": [ "logs:CreateLogStream", "logs:PutRetentionPolicy" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/application-discovery-service/firehose*" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSApplicationDiscoveryServiceFirehose", "Condition": { "StringLike": { "iam:PassedToService": "firehose.amazonaws.com" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/AWSApplicationDiscoveryServiceFirehose", "Condition": { "StringLike": { "iam:PassedToService": "firehose.amazonaws.com" } } } ] } } }, "createdDate": "2018-08-09T20:22:01.000Z", "lastUpdatedDate": "2018-08-13T22:31:21.000Z" }, "AWSAutoScalingPlansEC2AutoScalingPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAutoScalingPlansEC2AutoScalingPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-08-23T22:46:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScheduledActions", "autoscaling:BatchPutScheduledUpdateGroupAction", "autoscaling:BatchDeleteScheduledAction" ], "Resource": "*" } ] } } }, "createdDate": "2018-08-23T22:46:59.000Z", "lastUpdatedDate": "2018-08-23T22:46:59.000Z" }, "WAFRegionalLoggingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/WAFRegionalLoggingServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-08-24T18:40:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-waf-logs-*" ] } ] } } }, "createdDate": "2018-08-24T18:40:55.000Z", "lastUpdatedDate": "2018-08-24T18:40:55.000Z" }, "WAFLoggingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/WAFLoggingServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-08-24T21:05:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-waf-logs-*" ] } ] } } }, "createdDate": "2018-08-24T21:05:47.000Z", "lastUpdatedDate": "2018-08-24T21:05:47.000Z" }, "AmazonFreeRTOSOTAUpdate": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonFreeRTOSOTAUpdate", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-08-27T22:43:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObjectVersion", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::afr-ota*" }, { "Effect": "Allow", "Action": [ "signer:StartSigningJob", "signer:DescribeSigningJob", "signer:GetSigningProfile", "signer:PutSigningProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iot:DeleteJob" ], "Resource": "arn:aws:iot:*:*:job/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:DeleteStream" ], "Resource": "arn:aws:iot:*:*:stream/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:CreateStream", "iot:CreateJob" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T20:11:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObjectVersion", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::afr-ota*" }, { "Effect": "Allow", "Action": [ "signer:StartSigningJob", "signer:DescribeSigningJob", "signer:GetSigningProfile", "signer:PutSigningProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucketVersions", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iot:DeleteJob" ], "Resource": "arn:aws:iot:*:*:job/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:DeleteStream" ], "Resource": "arn:aws:iot:*:*:stream/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:CreateStream", "iot:CreateJob" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-18T17:47:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObjectVersion", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::afr-ota*" }, { "Effect": "Allow", "Action": [ "signer:StartSigningJob", "signer:DescribeSigningJob", "signer:GetSigningProfile", "signer:PutSigningProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucketVersions", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iot:DeleteJob", "iot:DescribeJob" ], "Resource": "arn:aws:iot:*:*:job/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:DeleteStream" ], "Resource": "arn:aws:iot:*:*:stream/AFR_OTA*" }, { "Effect": "Allow", "Action": [ "iot:CreateStream", "iot:CreateJob" ], "Resource": "*" } ] } } }, "createdDate": "2018-08-27T22:43:07.000Z", "lastUpdatedDate": "2020-12-18T17:47:30.000Z" }, "AWSXRayDaemonWriteAccess": { "arn": "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-08-28T23:00:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-08-28T23:00:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSXRayDaemonWriteAccess", "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-08-28T23:00:33.000Z", "lastUpdatedDate": "2024-02-13T21:58:30.000Z" }, "AmazonConnectServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonConnectServiceLinkedRolePolicy", "latestVersionId": "v24", "versionsCount": 24, "versions": { "v1": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-09-25T21:29:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" } ] } }, "v3": { "createdDate": "2020-10-08T01:40:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] } ] } }, "v4": { "createdDate": "2021-04-14T00:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-11T20:33:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjects" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/CTR", "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/_asset" ] }, { "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-12-09T22:12:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjects" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/CTR", "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/_asset" ] }, { "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v7": { "createdDate": "2022-06-27T19:35:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjects" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v8": { "createdDate": "2022-11-07T19:01:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v9": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v10": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowReadCalculatedAttributesForProfile", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v11": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowReadCalculatedAttributesForProfile", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v12": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v13": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v14": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v15": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v16": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] } ] } }, "v17": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] } ] } }, "v18": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v19": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } } ] } }, "v20": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } }, { "Sid": "AllowSocialMessagingOperations", "Effect": "Allow", "Action": [ "social-messaging:SendWhatsAppMessage", "social-messaging:PostWhatsAppMessageMedia", "social-messaging:GetWhatsAppMessageMedia", "social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber" ], "Resource": "arn:aws:social-messaging:*:*:phone-number-id/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v21": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } }, { "Sid": "AllowSocialMessagingOperations", "Effect": "Allow", "Action": [ "social-messaging:SendWhatsAppMessage", "social-messaging:PostWhatsAppMessageMedia", "social-messaging:GetWhatsAppMessageMedia", "social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber" ], "Resource": "arn:aws:social-messaging:*:*:phone-number-id/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMobileTargetingOperationsForConnect", "Effect": "Allow", "Action": "mobiletargeting:SendMessages", "Resource": "arn:aws:mobiletargeting:*:*:apps/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v22": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:GetIntegration", "profile:PutIntegration", "profile:DeleteIntegration", "profile:ListEventTriggers", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowCustomerProfilesEventTriggerForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateEventTrigger", "profile:GetEventTrigger", "profile:UpdateEventTrigger", "profile:DeleteEventTrigger" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/event-triggers/*" ] }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } }, { "Sid": "AllowSocialMessagingOperations", "Effect": "Allow", "Action": [ "social-messaging:SendWhatsAppMessage", "social-messaging:PostWhatsAppMessageMedia", "social-messaging:GetWhatsAppMessageMedia", "social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber" ], "Resource": "arn:aws:social-messaging:*:*:phone-number-id/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMobileTargetingOperationsForConnect", "Effect": "Allow", "Action": "mobiletargeting:SendMessages", "Resource": "arn:aws:mobiletargeting:*:*:apps/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v23": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:GetIntegration", "profile:PutIntegration", "profile:DeleteIntegration", "profile:ListEventTriggers", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowCustomerProfilesEventTriggerForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateEventTrigger", "profile:GetEventTrigger", "profile:UpdateEventTrigger", "profile:DeleteEventTrigger" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/event-triggers/*" ] }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate", "wisdom:CreateAIAgent", "wisdom:CreateAIAgentVersion", "wisdom:DeleteAIAgent", "wisdom:DeleteAIAgentVersion", "wisdom:UpdateAIAgent", "wisdom:UpdateAssistantAIAgent", "wisdom:RemoveAssistantAIAgent", "wisdom:GetAIAgent", "wisdom:ListAIAgents", "wisdom:ListAIAgentVersions", "wisdom:CreateAIPrompt", "wisdom:CreateAIPromptVersion", "wisdom:DeleteAIPrompt", "wisdom:DeleteAIPromptVersion", "wisdom:UpdateAIPrompt", "wisdom:GetAIPrompt", "wisdom:ListAIPrompts", "wisdom:ListAIPromptVersions", "wisdom:CreateAIGuardrail", "wisdom:CreateAIGuardrailVersion", "wisdom:DeleteAIGuardrail", "wisdom:DeleteAIGuardrailVersion", "wisdom:UpdateAIGuardrail", "wisdom:GetAIGuardrail", "wisdom:ListAIGuardrails", "wisdom:ListAIGuardrailVersions", "wisdom:CreateAssistant", "wisdom:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } }, { "Sid": "AllowSocialMessagingOperations", "Effect": "Allow", "Action": [ "social-messaging:SendWhatsAppMessage", "social-messaging:PostWhatsAppMessageMedia", "social-messaging:GetWhatsAppMessageMedia", "social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber" ], "Resource": "arn:aws:social-messaging:*:*:phone-number-id/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMobileTargetingOperationsForConnect", "Effect": "Allow", "Action": "mobiletargeting:SendMessages", "Resource": "arn:aws:mobiletargeting:*:*:apps/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v24": { "createdDate": "2018-09-07T00:21:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:*" ], "Resource": [ "*" ] }, { "Sid": "AllowDeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*" }, { "Sid": "AllowS3ObjectForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amazon-connect-*/*" ] }, { "Sid": "AllowGetBucketMetadataForConnectBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::amazon-connect-*" ] }, { "Sid": "AllowConnectLogGroupAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/connect/*:*" ] }, { "Sid": "AllowListLexBotAccess", "Effect": "Allow", "Action": [ "lex:ListBots", "lex:ListBotAliases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesForConnectDomain", "Effect": "Allow", "Action": [ "profile:SearchProfiles", "profile:CreateProfile", "profile:UpdateProfile", "profile:AddProfileKey", "profile:ListProfileObjectTypes", "profile:ListCalculatedAttributeDefinitions", "profile:ListCalculatedAttributesForProfile", "profile:GetDomain", "profile:ListIntegrations", "profile:GetIntegration", "profile:PutIntegration", "profile:DeleteIntegration", "profile:ListEventTriggers", "profile:ListSegmentDefinitions", "profile:ListProfileAttributeValues", "profile:CreateSegmentEstimate", "profile:GetSegmentEstimate", "profile:BatchGetProfile", "profile:BatchGetCalculatedAttributeForProfile", "profile:GetSegmentMembership" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Sid": "AllowCustomerProfilesEventTriggerForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateEventTrigger", "profile:GetEventTrigger", "profile:UpdateEventTrigger", "profile:DeleteEventTrigger" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/event-triggers/*" ] }, { "Sid": "AllowReadPermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:ListProfileObjects", "profile:GetProfileObjectType", "profile:ListObjectTypeAttributes" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowListIntegrationForCustomerProfile", "Effect": "Allow", "Action": [ "profile:ListAccountIntegrations" ], "Resource": "*" }, { "Sid": "AllowReadForCustomerProfileObjectTemplates", "Effect": "Allow", "Action": [ "profile:ListProfileObjectTypeTemplates", "profile:GetProfileObjectTypeTemplate" ], "Resource": "arn:aws:profile:*:*:/templates*" }, { "Sid": "AllowWisdomForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:CreateContent", "wisdom:DeleteContent", "wisdom:CreateKnowledgeBase", "wisdom:GetAssistant", "wisdom:GetKnowledgeBase", "wisdom:GetContent", "wisdom:GetRecommendations", "wisdom:GetSession", "wisdom:NotifyRecommendationsReceived", "wisdom:QueryAssistant", "wisdom:StartContentUpload", "wisdom:UpdateContent", "wisdom:UntagResource", "wisdom:TagResource", "wisdom:CreateSession", "wisdom:CreateQuickResponse", "wisdom:GetQuickResponse", "wisdom:SearchQuickResponses", "wisdom:StartImportJob", "wisdom:GetImportJob", "wisdom:ListImportJobs", "wisdom:ListQuickResponses", "wisdom:UpdateQuickResponse", "wisdom:DeleteQuickResponse", "wisdom:PutFeedback", "wisdom:ListContentAssociations", "wisdom:CreateMessageTemplate", "wisdom:UpdateMessageTemplate", "wisdom:UpdateMessageTemplateMetadata", "wisdom:GetMessageTemplate", "wisdom:DeleteMessageTemplate", "wisdom:ListMessageTemplates", "wisdom:SearchMessageTemplates", "wisdom:ActivateMessageTemplate", "wisdom:DeactivateMessageTemplate", "wisdom:CreateMessageTemplateVersion", "wisdom:ListMessageTemplateVersions", "wisdom:CreateMessageTemplateAttachment", "wisdom:DeleteMessageTemplateAttachment", "wisdom:RenderMessageTemplate", "wisdom:CreateAIAgent", "wisdom:CreateAIAgentVersion", "wisdom:DeleteAIAgent", "wisdom:DeleteAIAgentVersion", "wisdom:UpdateAIAgent", "wisdom:UpdateAssistantAIAgent", "wisdom:RemoveAssistantAIAgent", "wisdom:GetAIAgent", "wisdom:ListAIAgents", "wisdom:ListAIAgentVersions", "wisdom:CreateAIPrompt", "wisdom:CreateAIPromptVersion", "wisdom:DeleteAIPrompt", "wisdom:DeleteAIPromptVersion", "wisdom:UpdateAIPrompt", "wisdom:GetAIPrompt", "wisdom:ListAIPrompts", "wisdom:ListAIPromptVersions", "wisdom:CreateAIGuardrail", "wisdom:CreateAIGuardrailVersion", "wisdom:DeleteAIGuardrail", "wisdom:DeleteAIGuardrailVersion", "wisdom:UpdateAIGuardrail", "wisdom:GetAIGuardrail", "wisdom:ListAIGuardrails", "wisdom:ListAIGuardrailVersions", "wisdom:CreateAssistant", "wisdom:ListTagsForResource", "wisdom:SendMessage", "wisdom:GetNextMessage", "wisdom:ListMessages" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowListOperationForWisdom", "Effect": "Allow", "Action": [ "wisdom:ListAssistants", "wisdom:ListKnowledgeBases" ], "Resource": "*" }, { "Sid": "AllowCustomerProfilesCalculatedAttributesForConnectDomain", "Effect": "Allow", "Action": [ "profile:GetCalculatedAttributeForProfile", "profile:CreateCalculatedAttributeDefinition", "profile:DeleteCalculatedAttributeDefinition", "profile:GetCalculatedAttributeDefinition", "profile:UpdateCalculatedAttributeDefinition" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/calculated-attributes/*" ] }, { "Sid": "AllowCustomerProfilesSegmentationForConnectDomain", "Effect": "Allow", "Action": [ "profile:CreateSegmentDefinition", "profile:GetSegmentDefinition", "profile:DeleteSegmentDefinition", "profile:CreateSegmentSnapshot", "profile:GetSegmentSnapshot" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/segment-definitions/*" ] }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } }, { "Sid": "AllowSMSVoiceOperationsForConnect", "Effect": "Allow", "Action": [ "sms-voice:SendTextMessage", "sms-voice:DescribePhoneNumbers" ], "Resource": "arn:aws:sms-voice:*:*:phone-number/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowCognitoForConnectEnabledTaggedResources", "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:ListUserPoolClients" ], "Resource": "arn:aws:cognito-idp:*:*:userpool/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True" } } }, { "Sid": "AllowWritePermissionForCustomerProfileObjects", "Effect": "Allow", "Action": [ "profile:PutProfileObject" ], "Resource": [ "arn:aws:profile:*:*:domains/amazon-connect-*/object-types/*" ] }, { "Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect", "Effect": "Allow", "Action": [ "chime:GetVoiceConnector" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect", "Effect": "Allow", "Action": [ "chime:ListVoiceConnectors" ], "Resource": "arn:aws:chime:*:*:vc/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionsForManagingReceiptRules", "Effect": "Allow", "Action": [ "ses:DescribeReceiptRule", "ses:UpdateReceiptRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESPermissionForManagingConnectProvidedSESIdentity", "Effect": "Allow", "Action": [ "ses:DeleteEmailIdentity" ], "Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SESConfigurationSetPermissionsForSendingEmail", "Effect": "Allow", "Action": [ "ses:SendRawEmail" ], "Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleToSESForReceiptRuleManagement", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole" ], "Condition": { "StringLike": { "iam:PassedToService": "ses.amazonaws.com" } } }, { "Sid": "AllowSocialMessagingOperations", "Effect": "Allow", "Action": [ "social-messaging:SendWhatsAppMessage", "social-messaging:PostWhatsAppMessageMedia", "social-messaging:GetWhatsAppMessageMedia", "social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber" ], "Resource": "arn:aws:social-messaging:*:*:phone-number-id/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectEnabled": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMobileTargetingOperationsForConnect", "Effect": "Allow", "Action": "mobiletargeting:SendMessages", "Resource": "arn:aws:mobiletargeting:*:*:apps/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2018-09-07T00:21:43.000Z", "lastUpdatedDate": "2025-03-12T20:22:06.000Z" }, "ElasticLoadBalancingReadOnly": { "arn": "arn:aws:iam::aws:policy/ElasticLoadBalancingReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-09-20T20:17:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances", "ec2:DescribeSecurityGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-29T01:44:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "arc-zonal-shift:GetManagedResource", "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" }, { "Effect": "Allow", "Action": [ "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-09-20T20:17:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": [ "elasticloadbalancing:Describe*", "elasticloadbalancing:Get*" ], "Resource": "*" }, { "Sid": "Statement2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Statement3", "Effect": "Allow", "Action": "arc-zonal-shift:GetManagedResource", "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" }, { "Sid": "Statement4", "Effect": "Allow", "Action": [ "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts" ], "Resource": "*" } ] } } }, "createdDate": "2018-09-20T20:17:09.000Z", "lastUpdatedDate": "2023-11-26T18:15:46.000Z" }, "ElasticLoadBalancingFullAccess": { "arn": "arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2018-09-20T20:42:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-12-03T18:07:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2018-12-12T18:49:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2019-03-25T21:33:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-12-04T20:01:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2021-08-26T18:32:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:DescribeVpcPeeringConnections", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2022-11-29T01:45:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:DescribeVpcPeeringConnections", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } }, { "Effect": "Allow", "Action": "arc-zonal-shift:*", "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" }, { "Effect": "Allow", "Action": [ "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2018-09-20T20:42:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeVpcPeeringConnections", "cognito-idp:DescribeUserPoolClient" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } }, { "Effect": "Allow", "Action": "arc-zonal-shift:*", "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" }, { "Effect": "Allow", "Action": [ "arc-zonal-shift:ListManagedResources", "arc-zonal-shift:ListZonalShifts" ], "Resource": "*" } ] } } }, "createdDate": "2018-09-20T20:42:07.000Z", "lastUpdatedDate": "2024-10-24T22:21:39.000Z" }, "LightsailExportAccess": { "arn": "arn:aws:iam::aws:policy/aws-service-role/LightsailExportAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-09-28T16:35:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/lightsail.amazonaws.com/AWSServiceRoleForLightsail*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:DescribeSnapshots", "ec2:CopyImage", "ec2:DescribeImages" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-01-15T01:45:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/lightsail.amazonaws.com/AWSServiceRoleForLightsail*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:DescribeSnapshots", "ec2:CopyImage", "ec2:DescribeImages" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetAccountPublicAccessBlock" ], "Resource": "*" } ] } } }, "createdDate": "2018-09-28T16:35:54.000Z", "lastUpdatedDate": "2022-01-15T01:45:33.000Z" }, "AmazonRedshiftQueryEditor": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftQueryEditor", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-10-04T22:50:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials", "redshift:ListSchemas", "redshift:ListTables", "redshift:ListDatabases", "redshift:ExecuteQuery", "redshift:FetchResults", "redshift:CancelQuery", "redshift:DescribeClusters", "redshift:DescribeQuery", "redshift:DescribeTable", "redshift:ViewQueriesFromConsole", "redshift:DescribeSavedQueries", "redshift:CreateSavedQuery", "redshift:DeleteSavedQueries", "redshift:ModifySavedQuery" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-09-09T19:51:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials", "redshift:ListSchemas", "redshift:ListTables", "redshift:ListDatabases", "redshift:ExecuteQuery", "redshift:FetchResults", "redshift:CancelQuery", "redshift:DescribeClusters", "redshift:DescribeQuery", "redshift:DescribeTable", "redshift:ViewQueriesFromConsole", "redshift:DescribeSavedQueries", "redshift:CreateSavedQuery", "redshift:DeleteSavedQueries", "redshift:ModifySavedQuery" ], "Resource": "*" }, { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerListPermissions", "Action": [ "secretsmanager:ListSecrets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerCreateGetPermissions", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } } ] } }, "v3": { "createdDate": "2020-09-11T01:07:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials", "redshift:ListSchemas", "redshift:ListTables", "redshift:ListDatabases", "redshift:ExecuteQuery", "redshift:FetchResults", "redshift:CancelQuery", "redshift:DescribeClusters", "redshift:DescribeQuery", "redshift:DescribeTable", "redshift:ViewQueriesFromConsole", "redshift:DescribeSavedQueries", "redshift:CreateSavedQuery", "redshift:DeleteSavedQueries", "redshift:ModifySavedQuery" ], "Resource": "*" }, { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2021-02-16T19:33:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials", "redshift:ListSchemas", "redshift:ListTables", "redshift:ListDatabases", "redshift:ExecuteQuery", "redshift:FetchResults", "redshift:CancelQuery", "redshift:DescribeClusters", "redshift:DescribeQuery", "redshift:DescribeTable", "redshift:ViewQueriesFromConsole", "redshift:DescribeSavedQueries", "redshift:CreateSavedQuery", "redshift:DeleteSavedQueries", "redshift:ModifySavedQuery" ], "Resource": "*" }, { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "DataAPIIAMSessionPermissionsRestriction", "Action": [ "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:ListStatements" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "SecretsManagerListPermissions", "Action": [ "secretsmanager:ListSecrets" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerCreateGetPermissions", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource" ], "Effect": "Allow", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/RedshiftQueryOwner": "${aws:userid}" } } } ] } } }, "createdDate": "2018-10-04T22:50:32.000Z", "lastUpdatedDate": "2021-02-16T19:33:45.000Z" }, "AWSGlueConsoleSageMakerNotebookFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSGlueConsoleSageMakerNotebookFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-10-05T17:52:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "sagemaker:ListNotebookInstances", "sagemaker:ListNotebookInstanceLifecycleConfigs", "cloudformation:ListStacks", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:StartNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/aws-glue-*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:TagKeys": "aws-glue-*" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2019-09-26T17:14:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "sagemaker:ListNotebookInstances", "cloudformation:ListStacks", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/aws-glue-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/aws-glue-*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:TagKeys": "aws-glue-*" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2021-07-15T15:24:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:*", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeVpcAttribute", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "rds:DescribeDBInstances", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "cloudformation:DescribeStacks", "cloudformation:GetTemplateSummary", "dynamodb:ListTables", "kms:ListAliases", "kms:DescribeKey", "sagemaker:ListNotebookInstances", "cloudformation:ListStacks", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/*aws-glue-*/*", "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/aws-glue*/*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/aws-glue-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/aws-glue-*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/aws-glue-*/*" }, "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ZeppelinInstance" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AWSGlueServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/AWSGlueServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-10-05T17:52:35.000Z", "lastUpdatedDate": "2021-07-15T15:24:19.000Z" }, "AmazonConnectReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonConnectReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-10-17T21:00:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:Get*", "connect:Describe*", "connect:List*", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Deny", "Action": "connect:GetFederationTokens", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-06T01:34:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:Get*", "connect:Describe*", "connect:List*", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "connect:GetFederationToken", "connect:GetFederationTokens" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-06T22:10:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:Get*", "connect:Describe*", "connect:List*", "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Deny", "Action": "connect:GetFederationTokens", "Resource": "*" } ] } }, "v4": { "createdDate": "2018-10-17T21:00:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectReadOnly", "Effect": "Allow", "Action": [ "connect:Get*", "connect:Describe*", "connect:List*", "ds:DescribeDirectories" ], "Resource": "*" }, { "Sid": "DenyConnectEmergencyAccess", "Effect": "Deny", "Action": "connect:AdminGetEmergencyAccessToken", "Resource": "*" } ] } } }, "createdDate": "2018-10-17T21:00:44.000Z", "lastUpdatedDate": "2024-06-19T15:15:33.000Z" }, "AWSCertificateManagerPrivateCAAuditor": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAAuditor", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-10-23T16:51:08.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:CreateCertificateAuthorityAuditReport", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" } } }, "v2": { "createdDate": "2018-12-07T20:41:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:CreateCertificateAuthorityAuditReport", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:ListTags" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-03-14T17:17:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:CreateCertificateAuthorityAuditReport", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-08-17T22:54:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:CreateCertificateAuthorityAuditReport", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:GetPolicy", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-23T16:51:08.000Z", "lastUpdatedDate": "2020-08-17T22:54:12.000Z" }, "AWSCertificateManagerPrivateCAUser": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAUser", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2018-10-23T16:53:33.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListCertificateAuthorities" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" } } }, "v2": { "createdDate": "2018-12-07T20:43:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:RevokeCertificate", "acm-pca:GetCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-06-20T17:42:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/EndEntityCertificate/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/EndEntityCertificate/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-03-14T17:17:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-10-23T16:53:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/EndEntityCertificate/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/EndEntityCertificate/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-23T16:53:33.000Z", "lastUpdatedDate": "2025-01-22T15:52:06.000Z" }, "AWSCertificateManagerPrivateCAFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-10-23T16:54:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:*" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-23T16:54:50.000Z", "lastUpdatedDate": "2018-10-23T16:54:50.000Z" }, "AWSCertificateManagerPrivateCAReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-10-23T16:57:04.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:ListTags" ], "Resource": "*" } } }, "v2": { "createdDate": "2019-03-14T17:17:21.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "*" } } }, "v3": { "createdDate": "2020-08-17T22:54:22.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:GetPolicy", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "*" } } } }, "createdDate": "2018-10-23T16:57:04.000Z", "lastUpdatedDate": "2020-08-17T22:54:22.000Z" }, "CloudTrailServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-10-24T21:21:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailFullAccess", "Effect": "Allow", "Action": [ "cloudtrail:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2022-11-03T20:35:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailFullAccess", "Effect": "Allow", "Action": [ "cloudtrail:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AwsOrgsDelegatedAdminAccess", "Effect": "Allow", "Action": "organizations:ListDelegatedAdministrators", "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "cloudtrail.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2018-10-24T21:21:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailFullAccess", "Effect": "Allow", "Action": [ "cloudtrail:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "AwsOrgsDelegatedAdminAccess", "Effect": "Allow", "Action": "organizations:ListDelegatedAdministrators", "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "cloudtrail.amazonaws.com" ] } } }, { "Sid": "DeleteTableAccess", "Effect": "Allow", "Action": "glue:DeleteTable", "Resource": [ "arn:*:glue:*:*:catalog", "arn:*:glue:*:*:database/aws:cloudtrail", "arn:*:glue:*:*:table/aws:cloudtrail/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DeregisterResourceAccess", "Effect": "Allow", "Action": "lakeformation:DeregisterResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2018-10-24T21:21:44.000Z", "lastUpdatedDate": "2023-11-27T01:18:10.000Z" }, "AWSGreengrassReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSGreengrassReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-10-30T16:01:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "greengrass:List*", "greengrass:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-30T16:01:43.000Z", "lastUpdatedDate": "2018-10-30T16:01:43.000Z" }, "AWSSSODirectoryReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSSSODirectoryReadOnly", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-10-31T23:49:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryReadOnly", "Effect": "Allow", "Action": [ "sso-directory:Search*", "sso-directory:Describe*", "sso-directory:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-26T22:37:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryReadOnly", "Effect": "Allow", "Action": [ "sso-directory:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Get*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-03-25T20:57:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryReadOnly", "Effect": "Allow", "Action": [ "sso-directory:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Get*", "identitystore:Describe*", "identitystore:List*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-11-16T18:17:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryReadOnly", "Effect": "Allow", "Action": [ "sso-directory:Search*", "sso-directory:Describe*", "sso-directory:List*", "sso-directory:Get*", "identitystore:Describe*", "identitystore:List*", "identitystore-auth:ListSessions", "identitystore-auth:BatchGetSession" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-31T23:49:32.000Z", "lastUpdatedDate": "2022-11-16T18:17:48.000Z" }, "AWSSSODirectoryAdministrator": { "arn": "arn:aws:iam::aws:policy/AWSSSODirectoryAdministrator", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-10-31T23:54:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryAdministrator", "Effect": "Allow", "Action": [ "sso-directory:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-03-25T20:31:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryAdministrator", "Effect": "Allow", "Action": [ "sso-directory:*", "identitystore:*", "sso:ListDirectoryAssociations" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-08-18T17:17:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryAdministrator", "Effect": "Allow", "Action": [ "sso-directory:*", "sso:ListDirectoryAssociations" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-10-20T20:34:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSSODirectoryAdministrator", "Effect": "Allow", "Action": [ "sso-directory:*", "identitystore:*", "identitystore-auth:*", "sso:ListDirectoryAssociations" ], "Resource": "*" } ] } } }, "createdDate": "2018-10-31T23:54:00.000Z", "lastUpdatedDate": "2022-10-20T20:34:07.000Z" }, "AWSOrganizationsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSOrganizationsFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-06T20:31:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-02-07T18:26:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:PutAlternateContact", "account:DeleteAlternateContact", "account:GetAlternateContact" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-08-16T20:42:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:PutAlternateContact", "account:DeleteAlternateContact", "account:GetAlternateContact" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "organizations.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-10-21T17:47:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:PutAlternateContact", "account:DeleteAlternateContact", "account:GetAlternateContact" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetContactInformation", "account:PutContactInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "organizations.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-12-22T18:22:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:PutAlternateContact", "account:DeleteAlternateContact", "account:GetAlternateContact", "account:GetContactInformation", "account:PutContactInformation", "account:ListRegions", "account:EnableRegion", "account:DisableRegion" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "organizations.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2018-11-06T20:31:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSOrganizationsFullAccess", "Effect": "Allow", "Action": "organizations:*", "Resource": "*" }, { "Sid": "AWSOrganizationsFullAccessAccount", "Effect": "Allow", "Action": [ "account:PutAlternateContact", "account:DeleteAlternateContact", "account:GetAlternateContact", "account:GetContactInformation", "account:PutContactInformation", "account:ListRegions", "account:EnableRegion", "account:DisableRegion" ], "Resource": "*" }, { "Sid": "AWSOrganizationsFullAccessCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "organizations.amazonaws.com" } } } ] } } }, "createdDate": "2018-11-06T20:31:57.000Z", "lastUpdatedDate": "2024-02-06T17:49:01.000Z" }, "AWSOrganizationsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-06T20:32:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-21T17:31:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetAlternateContact" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetContactInformation" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-02-07T18:17:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetAlternateContact" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-12-22T18:08:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "account:GetAlternateContact", "account:GetContactInformation", "account:ListRegions" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-11-06T20:32:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSOrganizationsReadOnly", "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Sid": "AWSOrganizationsReadOnlyAccount", "Effect": "Allow", "Action": [ "account:GetAlternateContact", "account:GetContactInformation", "account:ListRegions" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2018-11-06T20:32:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSOrganizationsReadOnly", "Effect": "Allow", "Action": [ "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Sid": "AWSOrganizationsReadOnlyAccount", "Effect": "Allow", "Action": [ "account:GetAlternateContact", "account:GetContactInformation", "account:ListRegions", "account:GetRegionOptStatus", "account:GetPrimaryEmail" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-06T20:32:38.000Z", "lastUpdatedDate": "2024-06-07T21:32:16.000Z" }, "AWSServiceRoleForIoTSiteWise": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForIoTSiteWise", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2018-11-14T19:19:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iotanalytics:ExecuteQuery", "Resource": "arn:aws:iotanalytics:*:*:datastore-index/*" } ] } }, "v3": { "createdDate": "2019-02-11T20:49:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "iotanalytics:ExecuteQuery", "Effect": "Allow", "Resource": "arn:aws:iotanalytics:*:*:datastore-index/*" }, { "Action": [ "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:GetAssociatedRole", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetResourceDefinitionVersion", "greengrass:ListCoreDefinitions", "greengrass:UpdateCoreDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateResourceDefinition" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:CreateAlias", "lambda:CreateFunction", "lambda:GetFunction", "lambda:ListVersionsByFunction", "lambda:UpdateFunctionCode", "lambda:PublishVersion", "lambda:UpdateAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:AWSIoTSiteWise*" }, { "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-11-19T23:28:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "iotanalytics:ExecuteQuery", "Effect": "Allow", "Resource": "arn:aws:iotanalytics:*:*:datastore-index/*" }, { "Action": [ "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:GetAssociatedRole", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetResourceDefinitionVersion", "greengrass:ListCoreDefinitions", "greengrass:UpdateCoreDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateResourceDefinition" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:CreateAlias", "lambda:CreateFunction", "lambda:UpdateFunctionCode", "lambda:PublishVersion", "lambda:ListVersionsByFunction" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:AWSIoTSiteWise*" }, { "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2019-11-06T21:34:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "iotanalytics:ExecuteQuery", "Effect": "Allow", "Resource": "arn:aws:iotanalytics:*:*:datastore-index/*" }, { "Action": [ "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:GetAssociatedRole", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetResourceDefinitionVersion", "greengrass:ListCoreDefinitions", "greengrass:UpdateCoreDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateResourceDefinition" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:CreateAlias", "lambda:CreateFunction", "lambda:GetFunction", "lambda:ListVersionsByFunction", "lambda:UpdateFunctionCode", "lambda:PublishVersion", "lambda:UpdateAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:AWSIoTSiteWise*" }, { "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*" } ] } }, "v5": { "createdDate": "2019-11-21T21:52:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "iotanalytics:ExecuteQuery", "Effect": "Allow", "Resource": "arn:aws:iotanalytics:*:*:datastore-index/*" }, { "Action": [ "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:GetAssociatedRole", "greengrass:GetConnectorDefinition", "greengrass:GetConnectorDefinitionVersion", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetResourceDefinitionVersion", "greengrass:ListCoreDefinitions", "greengrass:UpdateCoreDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateResourceDefinition" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:CreateAlias", "lambda:CreateFunction", "lambda:GetFunction", "lambda:ListVersionsByFunction", "lambda:UpdateFunctionCode", "lambda:PublishVersion", "lambda:UpdateAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:AWSIoTSiteWise*" }, { "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Effect": "Allow", "Resource": "*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*" } ] } }, "v6": { "createdDate": "2020-03-26T21:02:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:GetAssociatedRole", "greengrass:GetConnectorDefinition", "greengrass:GetConnectorDefinitionVersion", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetResourceDefinitionVersion", "greengrass:ListCoreDefinitions", "greengrass:UpdateCoreDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateResourceDefinition" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:CreateAlias", "lambda:CreateFunction", "lambda:GetFunction", "lambda:ListVersionsByFunction", "lambda:UpdateFunctionCode", "lambda:PublishVersion", "lambda:UpdateAlias" ], "Resource": "arn:aws:lambda:*:*:function:AWSIoTSiteWise*" }, { "Effect": "Allow", "Action": [ "iot:GetThingShadow", "iot:UpdateThingShadow" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*" } ] } }, "v7": { "createdDate": "2020-04-25T02:15:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "greengrass:GetAssociatedRole", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*", "Effect": "Allow" }, { "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*", "Effect": "Allow" } ] } }, "v8": { "createdDate": "2018-11-14T19:19:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSiteWiseReadGreenGrass", "Effect": "Allow", "Action": [ "greengrass:GetAssociatedRole", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupVersion" ], "Resource": "*" }, { "Sid": "AllowSiteWiseAccessLogGroup", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*" }, { "Sid": "AllowSiteWiseAccessLog", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*" }, { "Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker", "Effect": "Allow", "Action": [ "iottwinmaker:GetWorkspace", "iottwinmaker:ExecuteQuery" ], "Resource": "arn:aws:iottwinmaker:*:*:workspace/*", "Condition": { "ForAnyValue:StringEquals": { "iottwinmaker:linkedServices": [ "IOTSITEWISE" ] } } } ] } } }, "createdDate": "2018-11-14T19:19:17.000Z", "lastUpdatedDate": "2023-11-13T18:27:50.000Z" }, "AWSResourceAccessManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSResourceAccessManagerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-14T19:28:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots" ], "Resource": "*" }, { "Sid": "AllowDeletionOfServiceLinkedRoleForResourceAccessManager", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ram.amazonaws.com/*" ] } ] } } }, "createdDate": "2018-11-14T19:28:28.000Z", "lastUpdatedDate": "2018-11-14T19:28:28.000Z" }, "AWSKeyManagementServiceCustomKeyStoresServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSKeyManagementServiceCustomKeyStoresServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-14T20:10:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudhsm:Describe*", "ec2:CreateNetworkInterface", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2018-11-14T20:10:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudhsm:Describe*", "ec2:CreateNetworkInterface", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-14T20:10:53.000Z", "lastUpdatedDate": "2023-11-10T19:03:34.000Z" }, "KafkaServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-11-15T23:31:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-23T19:58:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "acm-pca:GetCertificateAuthorityCertificate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-08-26T20:40:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "acm-pca:GetCertificateAuthorityCertificate", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "ArnLike": { "secretsmanager:SecretId": "arn:*:secretsmanager:*:*:secret:AmazonMSK_*" } } } ] } }, "v4": { "createdDate": "2023-04-28T00:39:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DescribeVpcEndpoints", "acm-pca:GetCertificateAuthorityCertificate", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint" ], "Resource": "arn:*:ec2:*:*:subnet/*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSMSKManaged": "true" }, "StringLike": { "ec2:ResourceTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "ArnLike": { "secretsmanager:SecretId": "arn:*:secretsmanager:*:*:secret:AmazonMSK_*" } } } ] } } }, "createdDate": "2018-11-15T23:31:48.000Z", "lastUpdatedDate": "2023-04-28T00:39:35.000Z" }, "AmazonElasticMapReduceEditorsRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceEditorsRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-16T21:55:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeSubnets", "elasticmapreduce:ListInstances", "elasticmapreduce:DescribeCluster" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:elasticmapreduce:editor-id", "aws:elasticmapreduce:job-flow-id" ] } } } ] } }, "v2": { "createdDate": "2023-02-09T22:39:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticmapreduce:ListInstances", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListSteps" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:elasticmapreduce:editor-id", "aws:elasticmapreduce:job-flow-id" ] } } } ] } } }, "createdDate": "2018-11-16T21:55:25.000Z", "lastUpdatedDate": "2023-02-09T22:39:29.000Z" }, "AmazonRDSDataFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRDSDataFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-11-20T21:29:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecretsManagerDbCredentialsAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rds-db-credentials/*" }, { "Sid": "RDSDataServiceAccess", "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory", "dbqms:DescribeQueryHistory", "rds-data:ExecuteSql", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:GetRandomPassword", "tag:GetResources" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-30T17:11:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecretsManagerDbCredentialsAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rds-db-credentials/*" }, { "Sid": "RDSDataServiceAccess", "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory", "dbqms:DescribeQueryHistory", "rds-data:ExecuteSql", "rds-data:ExecuteStatement", "rds-data:BatchExecuteStatement", "rds-data:BeginTransaction", "rds-data:CommitTransaction", "rds-data:RollbackTransaction", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:GetRandomPassword", "tag:GetResources" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-20T21:58:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecretsManagerDbCredentialsAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rds-db-credentials/*" }, { "Sid": "RDSDataServiceAccess", "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory", "rds-data:ExecuteSql", "rds-data:ExecuteStatement", "rds-data:BatchExecuteStatement", "rds-data:BeginTransaction", "rds-data:CommitTransaction", "rds-data:RollbackTransaction", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:GetRandomPassword", "tag:GetResources" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-20T21:29:36.000Z", "lastUpdatedDate": "2019-11-20T21:58:46.000Z" }, "AWSRoboMakerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSRoboMakerReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2020-08-28T23:10:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "robomaker:List*", "robomaker:BatchDescribe*", "robomaker:Describe*", "robomaker:Get*" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2018-11-26T05:30:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "robomaker:ListDeploymentJobs", "robomaker:BatchDescribeSimulationJob", "robomaker:DescribeFleet", "robomaker:DescribeSimulationApplication", "robomaker:DescribeRobotApplication", "robomaker:ListFleets", "robomaker:ListSimulationJobs", "robomaker:DescribeDeploymentJob", "robomaker:DescribeSimulationJob", "robomaker:DescribeRobot", "robomaker:ListRobots", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-26T05:30:50.000Z", "lastUpdatedDate": "2020-08-28T23:10:18.000Z" }, "AWSRoboMakerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSRoboMakerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-26T05:33:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } } }, "createdDate": "2018-11-26T05:33:19.000Z", "lastUpdatedDate": "2018-11-26T05:33:19.000Z" }, "AWSRoboMakerServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSRoboMakerServicePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-26T06:30:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2019-04-04T22:15:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListVersionsByFunction", "lambda:GetAlias", "lambda:UpdateAlias", "lambda:CreateAlias", "lambda:DeleteAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-01-23T20:44:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction", "robomaker:CreateSimulationJob", "robomaker:CancelSimulationJob" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListVersionsByFunction", "lambda:GetAlias", "lambda:UpdateAlias", "lambda:CreateAlias", "lambda:DeleteAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2020-02-04T19:33:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction", "robomaker:CreateSimulationJob", "robomaker:CancelSimulationJob" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "robomaker:TagResource" ], "Effect": "Allow", "Resource": "arn:aws:robomaker:*:*:/createsimulationjob" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListVersionsByFunction", "lambda:GetAlias", "lambda:UpdateAlias", "lambda:CreateAlias", "lambda:DeleteAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2020-08-04T20:38:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction", "robomaker:CreateSimulationJob", "robomaker:CancelSimulationJob" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "robomaker:TagResource" ], "Effect": "Allow", "Resource": [ "arn:aws:robomaker:*:*:/createsimulationjob", "arn:aws:robomaker:*:*:simulation-job/*" ] }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListVersionsByFunction", "lambda:GetAlias", "lambda:UpdateAlias", "lambda:CreateAlias", "lambda:DeleteAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2021-11-11T22:23:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "greengrass:CreateDeployment", "greengrass:CreateGroupVersion", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetAssociatedRole", "lambda:CreateFunction", "robomaker:CreateSimulationJob", "robomaker:CancelSimulationJob" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "robomaker:TagResource" ], "Effect": "Allow", "Resource": "arn:aws:robomaker:*:*:simulation-job/*" }, { "Action": [ "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListVersionsByFunction", "lambda:GetAlias", "lambda:UpdateAlias", "lambda:CreateAlias", "lambda:DeleteAlias" ], "Effect": "Allow", "Resource": "arn:aws:lambda:*:*:function:aws-robomaker-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "robomaker.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-26T06:30:08.000Z", "lastUpdatedDate": "2021-11-11T22:23:45.000Z" }, "AWSVPCTransitGatewayServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-04-15T16:31:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:AssignIpv6Addresses", "ec2:UnAssignIpv6Addresses" ], "Resource": "*", "Effect": "Allow", "Sid": "0" } ] } }, "v1": { "createdDate": "2018-11-26T16:21:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission" ], "Resource": "*", "Effect": "Allow", "Sid": "0" } ] } } }, "createdDate": "2018-11-26T16:21:17.000Z", "lastUpdatedDate": "2021-04-15T16:31:44.000Z" }, "AWSLicenseManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerServiceRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-11-26T19:02:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-11-15T22:10:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicenseConfiguration", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:ListUsageForLicenseConfiguration" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2021-03-09T20:23:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/license-management.marketplace.amazonaws.com/AWSServiceRoleForMarketplaceLicenseManagement" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-management.marketplace.amazonaws.com" } } }, { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicense*", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:ListUsageForLicenseConfiguration", "license-manager:ListDistributedGrants" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2020-12-03T08:38:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicense*", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:ListUsageForLicenseConfiguration", "license-manager:ListDistributedGrants" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2021-06-15T17:06:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/license-management.marketplace.amazonaws.com/AWSServiceRoleForMarketplaceLicenseManagement" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-management.marketplace.amazonaws.com" } } }, { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicense*", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:List*" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2021-06-17T03:54:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/license-management.marketplace.amazonaws.com/AWSServiceRoleForMarketplaceLicenseManagement" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-management.marketplace.amazonaws.com" } } }, { "Sid": "IAMPermissionsForCreatingMemberSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:*:iam::*:role/aws-service-role/license-manager.member-account.amazonaws.com/AWSServiceRoleForAWSLicenseManagerMemberAccountRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-manager.amazonaws.com" } } }, { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicense*", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:List*" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2021-07-30T01:43:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/license-management.marketplace.amazonaws.com/AWSServiceRoleForMarketplaceLicenseManagement" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-management.marketplace.amazonaws.com" } } }, { "Sid": "IAMPermissionsForCreatingMemberSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:*:iam::*:role/aws-service-role/license-manager.member-account.amazonaws.com/AWSServiceRoleForAWSLicenseManagerMemberAccountRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "license-manager.member-account.amazonaws.com" } } }, { "Sid": "S3BucketPermissions1", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3BucketPermissions2", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "SNSAccountPermissions", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:aws-license-manager-service-*" ] }, { "Sid": "SNSTopicPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeHosts" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:GetServiceSettings", "license-manager:GetLicense*", "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-26T19:02:53.000Z", "lastUpdatedDate": "2021-07-30T01:43:19.000Z" }, "AWSLicenseManagerMasterAccountRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerMasterAccountRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2018-11-26T19:03:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetBucketPolicy", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions1", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions2", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*/resource_sync/*" ] }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetPartition", "glue:GetPartitions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions1", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareAssociations", "ram:TagResource" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions2", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/Service": "LicenseManager" } } }, { "Sid": "RAMPermissions3", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ram:ResourceTag/Service": "LicenseManager" } } } ] } }, "v2": { "createdDate": "2019-08-22T20:05:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetBucketPolicy", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions1", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions2", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*/resource_sync/*" ] }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetPartition", "glue:GetPartitions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions1", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareAssociations", "ram:TagResource" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions2", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/Service": "LicenseManager" } } }, { "Sid": "RAMPermissions3", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ram:ResourceTag/Service": "LicenseManager" } } }, { "Sid": "IamPermission", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*" ], "Condition": { "StringEquals": { "iam:PassedToService": "byol.amazonaws.com" } } }, { "Sid": "CloudformationPermission", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LicenseManagerCrossAccountCloudDiscoveryStack/*" ] }, { "Sid": "GlueUpdatePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:UpdateJob", "glue:UpdateCrawler" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:crawler/LicenseManagerResourceSynDataCrawler", "arn:aws:glue:*:*:job/LicenseManagerResourceSynDataProcessJob", "arn:aws:glue:*:*:table/license_manager_resource_inventory_db/*", "arn:aws:glue:*:*:table/license_manager_resource_sync/*", "arn:aws:glue:*:*:database/license_manager_resource_inventory_db", "arn:aws:glue:*:*:database/license_manager_resource_sync" ] } ] } }, "v3": { "createdDate": "2019-08-29T22:56:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetBucketPolicy", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions1", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions2", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*/resource_sync/*" ] }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetPartition", "glue:GetPartitions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions1", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareAssociations", "ram:TagResource" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions2", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/Service": "LicenseManager" } } }, { "Sid": "RAMPermissions3", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ram:ResourceTag/Service": "LicenseManager" } } }, { "Sid": "IAMGetRoles", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "*" ] }, { "Sid": "IAMPassRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/LicenseManagerServiceResourceDataSyncRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid": "CloudformationPermission", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LicenseManagerCrossAccountCloudDiscoveryStack/*" ] }, { "Sid": "GlueUpdatePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:UpdateJob", "glue:UpdateCrawler" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:crawler/LicenseManagerResourceSynDataCrawler", "arn:aws:glue:*:*:job/LicenseManagerResourceSynDataProcessJob", "arn:aws:glue:*:*:table/license_manager_resource_inventory_db/*", "arn:aws:glue:*:*:table/license_manager_resource_sync/*", "arn:aws:glue:*:*:database/license_manager_resource_inventory_db", "arn:aws:glue:*:*:database/license_manager_resource_sync" ] } ] } }, "v4": { "createdDate": "2021-11-18T02:02:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetBucketPolicy", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions1", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions2", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*/resource_sync/*" ] }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetPartition", "glue:GetPartitions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions1", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareAssociations", "ram:TagResource" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions2", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/Service": "LicenseManager" } } }, { "Sid": "RAMPermissions3", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Service": "LicenseManager" } } }, { "Sid": "IAMGetRoles", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "*" ] }, { "Sid": "IAMPassRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/LicenseManagerServiceResourceDataSyncRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid": "CloudformationPermission", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LicenseManagerCrossAccountCloudDiscoveryStack/*" ] }, { "Sid": "GlueUpdatePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:UpdateJob", "glue:UpdateCrawler" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:crawler/LicenseManagerResourceSynDataCrawler", "arn:aws:glue:*:*:job/LicenseManagerResourceSynDataProcessJob", "arn:aws:glue:*:*:table/license_manager_resource_inventory_db/*", "arn:aws:glue:*:*:table/license_manager_resource_sync/*", "arn:aws:glue:*:*:database/license_manager_resource_inventory_db", "arn:aws:glue:*:*:database/license_manager_resource_sync" ] } ] } }, "v5": { "createdDate": "2022-05-31T20:50:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetBucketPolicy", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions1", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*" ] }, { "Sid": "S3ObjectPermissions2", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-license-manager-service-*/resource_sync/*" ] }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution" ], "Resource": [ "*" ] }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetPartition", "glue:GetPartitions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions1", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareAssociations", "ram:TagResource" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions2", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/Service": "LicenseManager" } } }, { "Sid": "RAMPermissions3", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/Service": "LicenseManager" } } }, { "Sid": "IAMGetRoles", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "*" ] }, { "Sid": "IAMPassRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/LicenseManagerServiceResourceDataSyncRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid": "CloudformationPermission", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LicenseManagerCrossAccountCloudDiscoveryStack/*" ] }, { "Sid": "GlueUpdatePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:UpdateJob", "glue:UpdateCrawler" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:crawler/LicenseManagerResourceSynDataCrawler", "arn:aws:glue:*:*:job/LicenseManagerResourceSynDataProcessJob", "arn:aws:glue:*:*:table/license_manager_resource_inventory_db/*", "arn:aws:glue:*:*:table/license_manager_resource_sync/*", "arn:aws:glue:*:*:database/license_manager_resource_inventory_db", "arn:aws:glue:*:*:database/license_manager_resource_sync" ] }, { "Sid": "RGPermissions", "Effect": "Allow", "Action": [ "resource-groups:PutGroupPolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-26T19:03:51.000Z", "lastUpdatedDate": "2022-05-31T20:50:26.000Z" }, "AWSLicenseManagerMemberAccountRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerMemberAccountRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2019-11-15T22:09:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource", "license-manager:GetLicenseConfiguration" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation", "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync", "ssm:ListResourceDataSync", "ssm:ListAssociations" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation", "ram:GetResourceShareInvitations" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2018-11-26T19:04:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LicenseManagerPermissions", "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": [ "*" ] }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:ListInventoryEntries", "ssm:GetInventory", "ssm:CreateAssociation", "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync", "ssm:ListResourceDataSync", "ssm:ListAssociations" ], "Resource": [ "*" ] }, { "Sid": "RAMPermissions", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation", "ram:GetResourceShareInvitations" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-26T19:04:32.000Z", "lastUpdatedDate": "2019-11-15T22:09:32.000Z" }, "ServerMigrationServiceLaunchRole": { "arn": "arn:aws:iam::aws:policy/service-role/ServerMigrationServiceLaunchRole", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-11-26T19:53:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:Describe*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-07-20T21:56:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:Describe*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-10-15T17:29:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "applicationinsights:Describe*", "applicationinsights:List*", "cloudformation:ListStackResources", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "applicationinsights:CreateApplication", "applicationinsights:CreateComponent", "applicationinsights:UpdateApplication", "applicationinsights:DeleteApplication", "applicationinsights:UpdateComponentConfiguration", "applicationinsights:DeleteComponent" ], "Resource": "arn:aws:applicationinsights:*:*:application/resource-group/sms-app-*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:GetGroup", "resource-groups:UpdateGroup", "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/sms-app-*", "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-09-30T17:50:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-26T19:53:06.000Z", "lastUpdatedDate": "2020-10-15T17:29:00.000Z" }, "GlobalAcceleratorReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/GlobalAcceleratorReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-27T02:41:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:Describe*", "globalaccelerator:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-11-27T02:41:00.000Z", "lastUpdatedDate": "2018-11-27T02:41:00.000Z" }, "GlobalAcceleratorFullAccess": { "arn": "arn:aws:iam::aws:policy/GlobalAcceleratorFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-27T02:44:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-07-08T22:15:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*" }, { "Action": "ec2:DescribeAddresses", "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2019-08-28T19:04:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*" }, { "Action": "ec2:DescribeAddresses", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/globalaccelerator.amazonaws.com/AWSServiceRoleForGlobalAccelerator*", "Condition": { "StringEquals": { "iam:AWSServiceName": "globalaccelerator.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2019-10-21T21:25:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInternetGateways" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/globalaccelerator.amazonaws.com/AWSServiceRoleForGlobalAccelerator*", "Condition": { "StringEquals": { "iam:AWSServiceName": "globalaccelerator.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2020-12-04T19:17:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeRegions", "ec2:DescribeSubnets" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/globalaccelerator.amazonaws.com/AWSServiceRoleForGlobalAccelerator*", "Condition": { "StringEquals": { "iam:AWSServiceName": "globalaccelerator.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-06-16T16:47:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "globalaccelerator:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeRegions" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/globalaccelerator.amazonaws.com/AWSServiceRoleForGlobalAccelerator*", "Condition": { "StringEquals": { "iam:AWSServiceName": "globalaccelerator.amazonaws.com" } } } ] } } }, "createdDate": "2018-11-27T02:44:44.000Z", "lastUpdatedDate": "2020-12-04T19:17:26.000Z" }, "AWSPrivateMarketplaceAdminFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPrivateMarketplaceAdminFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-27T16:32:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:CreatePrivateMarketplace", "aws-marketplace:CreatePrivateMarketplaceProfile", "aws-marketplace:UpdatePrivateMarketplaceProfile", "aws-marketplace:StartPrivateMarketplace", "aws-marketplace:StopPrivateMarketplace", "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:DescribePrivateMarketplaceProfile", "aws-marketplace:DescribePrivateMarketplaceStatus", "aws-marketplace:ListPrivateMarketplaceProducts", "aws-marketplace:DescribePrivateMarketplaceProducts" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-10-28T21:48:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:CreatePrivateMarketplace", "aws-marketplace:StartPrivateMarketplace", "aws-marketplace:StopPrivateMarketplace", "aws-marketplace:DescribePrivateMarketplaceStatus", "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceProducts", "aws-marketplace:DescribePrivateMarketplaceProducts", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests", "aws-marketplace:UpdatePrivateMarketplaceSettings", "aws-marketplace:DescribePrivateMarketplaceSettings", "aws-marketplace:CreatePrivateMarketplaceProfile", "aws-marketplace:UpdatePrivateMarketplaceProfile", "aws-marketplace:DescribePrivateMarketplaceProfile" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2020-12-03T15:12:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:CreatePrivateMarketplace", "aws-marketplace:StartPrivateMarketplace", "aws-marketplace:StopPrivateMarketplace", "aws-marketplace:DescribePrivateMarketplaceStatus", "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceProducts", "aws-marketplace:DescribePrivateMarketplaceProducts", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests", "aws-marketplace:UpdatePrivateMarketplaceSettings", "aws-marketplace:DescribePrivateMarketplaceSettings", "aws-marketplace:CreatePrivateMarketplaceProfile", "aws-marketplace:UpdatePrivateMarketplaceProfile", "aws-marketplace:DescribePrivateMarketplaceProfile" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-08-27T15:34:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-12-07T20:02:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v6": { "createdDate": "2018-11-27T16:32:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PrivateMarketplaceRequestPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": [ "*" ] }, { "Sid": "PrivateMarketplaceCatalogAPIPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" }, { "Sid": "PrivateMarketplaceCatalogTaggingPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "PrivateMarketplaceOrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-27T16:32:32.000Z", "lastUpdatedDate": "2024-02-14T22:05:08.000Z" }, "ComprehendMedicalFullAccess": { "arn": "arn:aws:iam::aws:policy/ComprehendMedicalFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-27T17:55:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "comprehendmedical:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-11-27T17:55:52.000Z", "lastUpdatedDate": "2018-11-27T17:55:52.000Z" }, "AWSCodeDeployRoleForECS": { "arn": "arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-11-27T20:40:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule", "lambda:InvokeFunction", "cloudwatch:DescribeAlarms", "sns:Publish", "s3:GetObject", "s3:GetObjectMetadata", "s3:GetObjectVersion" ], "Resource": "*", "Effect": "Allow" } ] } }, "v2": { "createdDate": "2018-12-19T17:57:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule", "lambda:InvokeFunction", "cloudwatch:DescribeAlarms", "sns:Publish", "s3:GetObject", "s3:GetObjectMetadata", "s3:GetObjectVersion" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "ecs-tasks.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2019-09-23T22:37:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule", "lambda:InvokeFunction", "cloudwatch:DescribeAlarms", "sns:Publish", "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": [ "ecs-tasks.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-27T20:40:57.000Z", "lastUpdatedDate": "2019-09-23T22:37:46.000Z" }, "AWSCodeDeployRoleForECSLimited": { "arn": "arn:aws:iam::aws:policy/AWSCodeDeployRoleForECSLimited", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-11-27T20:42:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "cloudwatch:DescribeAlarms" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:CodeDeployTopic_*", "Effect": "Allow" }, { "Action": [ "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectMetadata", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" } ] } }, "v2": { "createdDate": "2018-12-19T18:06:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "cloudwatch:DescribeAlarms" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:CodeDeployTopic_*", "Effect": "Allow" }, { "Action": [ "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectMetadata", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsTaskExecutionRole", "arn:aws:iam::*:role/ECSTaskExecution*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ecs-tasks.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2019-09-23T22:10:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:DescribeServices", "ecs:CreateTaskSet", "ecs:UpdateServicePrimaryTaskSet", "ecs:DeleteTaskSet", "cloudwatch:DescribeAlarms" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:CodeDeployTopic_*", "Effect": "Allow" }, { "Action": [ "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyRule" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/ecsTaskExecutionRole", "arn:aws:iam::*:role/ECSTaskExecution*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "ecs-tasks.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-27T20:42:42.000Z", "lastUpdatedDate": "2019-09-23T22:10:29.000Z" }, "TranslateFullAccess": { "arn": "arn:aws:iam::aws:policy/TranslateFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-27T23:36:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:*", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-01-08T21:22:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "translate:*", "comprehend:DetectDominantLanguage", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-11-27T23:36:20.000Z", "lastUpdatedDate": "2020-01-08T21:22:27.000Z" }, "AWSSecurityHubServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSecurityHubServiceRolePolicy", "latestVersionId": "v14", "versionsCount": 14, "versions": { "v1": { "createdDate": "2018-11-27T23:47:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v2": { "createdDate": "2019-07-12T21:11:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v3": { "createdDate": "2020-02-05T21:38:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v6": { "createdDate": "2020-08-31T20:29:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "organizations:ListAccounts", "organizations:DescribeAccount" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v4": { "createdDate": "2020-04-08T20:26:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v5": { "createdDate": "2020-04-21T19:59:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v7": { "createdDate": "2020-09-21T19:59:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v9": { "createdDate": "2021-07-14T20:32:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "config:PutEvaluations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v8": { "createdDate": "2021-06-29T19:55:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:PutEvaluations" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v10": { "createdDate": "2023-03-17T23:50:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "iam:GetCredentialReport", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "config:PutEvaluations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" } ] } }, "v11": { "createdDate": "2018-11-27T23:47:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "organizations:ListAccounts", "config:PutEvaluations", "iam:GetCredentialReport", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "securityhub:BatchDisableStandards", "securityhub:BatchEnableStandards", "securityhub:BatchUpdateStandardsControlAssociations", "securityhub:CreateMembers", "securityhub:DeleteMembers", "securityhub:DescribeHub", "securityhub:DescribeOrganizationConfiguration", "securityhub:DescribeStandards", "securityhub:DescribeStandardsControls", "securityhub:DisassociateMembers", "securityhub:DisableSecurityHub", "securityhub:EnableSecurityHub", "securityhub:GetEnabledStandards", "securityhub:ListStandardsControlAssociations", "securityhub:ListSecurityControlDefinitions", "securityhub:UpdateOrganizationConfiguration", "securityhub:UpdateSecurityHubConfiguration", "securityhub:UpdateStandardsControl" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "securityhub.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2018-11-27T23:47:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "organizations:ListAccounts", "config:PutEvaluations", "iam:GetCredentialReport", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "securityhub:BatchDisableStandards", "securityhub:BatchEnableStandards", "securityhub:BatchUpdateStandardsControlAssociations", "securityhub:BatchGetStandardsControlAssociations", "securityhub:CreateMembers", "securityhub:DeleteMembers", "securityhub:DescribeHub", "securityhub:DescribeOrganizationConfiguration", "securityhub:DescribeStandards", "securityhub:DescribeStandardsControls", "securityhub:DisassociateMembers", "securityhub:DisableSecurityHub", "securityhub:EnableSecurityHub", "securityhub:GetEnabledStandards", "securityhub:ListStandardsControlAssociations", "securityhub:ListSecurityControlDefinitions", "securityhub:UpdateOrganizationConfiguration", "securityhub:UpdateSecurityHubConfiguration", "securityhub:UpdateStandardsControl" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "securityhub.amazonaws.com" ] } } } ] } }, "v13": { "createdDate": "2018-11-27T23:47:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityHubServiceRolePermissions", "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "organizations:ListAccounts", "config:PutEvaluations", "tag:GetResources", "iam:GetCredentialReport", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "securityhub:BatchDisableStandards", "securityhub:BatchEnableStandards", "securityhub:BatchUpdateStandardsControlAssociations", "securityhub:BatchGetStandardsControlAssociations", "securityhub:CreateMembers", "securityhub:DeleteMembers", "securityhub:DescribeHub", "securityhub:DescribeOrganizationConfiguration", "securityhub:DescribeStandards", "securityhub:DescribeStandardsControls", "securityhub:DisassociateMembers", "securityhub:DisableSecurityHub", "securityhub:EnableSecurityHub", "securityhub:GetEnabledStandards", "securityhub:ListStandardsControlAssociations", "securityhub:ListSecurityControlDefinitions", "securityhub:UpdateOrganizationConfiguration", "securityhub:UpdateSecurityHubConfiguration", "securityhub:UpdateStandardsControl" ], "Resource": "*" }, { "Sid": "SecurityHubServiceRoleConfigPermissions", "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" }, { "Sid": "SecurityHubServiceRoleOrganizationsPermissions", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "securityhub.amazonaws.com" ] } } } ] } }, "v14": { "createdDate": "2018-11-27T23:47:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityHubServiceRolePermissions", "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "logs:DescribeMetricFilters", "sns:ListSubscriptionsByTopic", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "iam:GenerateCredentialReport", "organizations:ListAccounts", "config:PutEvaluations", "tag:GetResources", "iam:GetCredentialReport", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "securityhub:BatchDisableStandards", "securityhub:BatchEnableStandards", "securityhub:BatchUpdateStandardsControlAssociations", "securityhub:BatchGetSecurityControls", "securityhub:BatchGetStandardsControlAssociations", "securityhub:CreateMembers", "securityhub:DeleteMembers", "securityhub:DescribeHub", "securityhub:DescribeOrganizationConfiguration", "securityhub:DescribeStandards", "securityhub:DescribeStandardsControls", "securityhub:DisassociateFromAdministratorAccount", "securityhub:DisassociateMembers", "securityhub:DisableSecurityHub", "securityhub:EnableSecurityHub", "securityhub:GetEnabledStandards", "securityhub:ListStandardsControlAssociations", "securityhub:ListSecurityControlDefinitions", "securityhub:UpdateOrganizationConfiguration", "securityhub:UpdateSecurityControl", "securityhub:UpdateSecurityHubConfiguration", "securityhub:UpdateStandardsControl" ], "Resource": "*" }, { "Sid": "SecurityHubServiceRoleConfigPermissions", "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*" }, { "Sid": "SecurityHubServiceRoleOrganizationsPermissions", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "securityhub.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-27T23:47:51.000Z", "lastUpdatedDate": "2023-11-27T03:46:47.000Z" }, "AWSSecurityHubFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityHubFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-11-27T23:54:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "securityhub:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "securityhub.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2018-11-27T23:54:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityHubAllowAll", "Effect": "Allow", "Action": "securityhub:*", "Resource": "*" }, { "Sid": "SecurityHubServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "securityhub.amazonaws.com" } } }, { "Sid": "OtherServicePermission", "Effect": "Allow", "Action": [ "guardduty:GetDetector", "guardduty:ListDetectors", "inspector2:BatchGetAccountStatus" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2018-11-27T23:54:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityHubAllowAll", "Effect": "Allow", "Action": "securityhub:*", "Resource": "*" }, { "Sid": "SecurityHubServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "securityhub.amazonaws.com" } } }, { "Sid": "OtherServicePermission", "Effect": "Allow", "Action": [ "guardduty:GetDetector", "guardduty:ListDetectors", "inspector2:BatchGetAccountStatus", "pricing:GetProducts" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-27T23:54:34.000Z", "lastUpdatedDate": "2024-04-23T18:35:45.000Z" }, "AWSSecurityHubReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityHubReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2018-11-28T01:34:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "securityhub:Get*", "securityhub:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-25T22:45:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "securityhub:Get*", "securityhub:List*", "securityhub:Describe*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-04-04T17:46:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "securityhub:Get*", "securityhub:List*", "securityhub:BatchGet*", "securityhub:Describe*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2018-11-28T01:34:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSecurityHubReadOnlyAccess", "Effect": "Allow", "Action": [ "securityhub:Get*", "securityhub:List*", "securityhub:BatchGet*", "securityhub:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-28T01:34:29.000Z", "lastUpdatedDate": "2024-02-22T23:45:59.000Z" }, "AmazonFSxServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonFSxServiceRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2018-11-28T10:38:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:AuthorizeApplication", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-18T13:25:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-11-12T20:19:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-08-20T12:51:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": "AmazonFSx.FileSystemId" } } }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonFSx.FileSystemId": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateRoute", "ec2:ReplaceRoute", "ec2:DeleteRoute" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonFSx": "ManagedByAmazonFSx" } } }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/fsx/*" }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" } ] } }, "v4": { "createdDate": "2021-06-07T21:03:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/fsx/*" }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" } ] } }, "v6": { "createdDate": "2023-07-26T17:57:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/FSx" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": "AmazonFSx.FileSystemId" } } }, { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonFSx.FileSystemId": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateRoute", "ec2:ReplaceRoute", "ec2:DeleteRoute" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonFSx": "ManagedByAmazonFSx" } } }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/fsx/*" }, { "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" } ] } }, "v7": { "createdDate": "2018-11-28T10:38:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateFileSystem", "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:GetAuthorizedApplicationDetails", "ds:UnauthorizeApplication", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DisassociateAddress", "ec2:GetSecurityGroupsForVpc", "route53:AssociateVPCWithHostedZone" ], "Resource": "*" }, { "Sid": "PutMetrics", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/FSx" } } }, { "Sid": "TagResourceNetworkInterface", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": "AmazonFSx.FileSystemId" } } }, { "Sid": "ManageNetworkInterface", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:ModifyNetworkInterfaceAttribute", "ec2:UnassignPrivateIpAddresses" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonFSx.FileSystemId": "false" } } }, { "Sid": "ManageRouteTable", "Effect": "Allow", "Action": [ "ec2:CreateRoute", "ec2:ReplaceRoute", "ec2:DeleteRoute" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonFSx": "ManagedByAmazonFSx" } } }, { "Sid": "PutCloudWatchLogs", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/fsx/*" }, { "Sid": "ManageAuditLogs", "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" } ] } } }, "createdDate": "2018-11-28T10:38:37.000Z", "lastUpdatedDate": "2024-01-10T20:53:47.000Z" }, "FSxDeleteServiceLinkedRoleAccess": { "arn": "arn:aws:iam::aws:policy/aws-service-role/FSxDeleteServiceLinkedRoleAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-28T10:40:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetRole" ], "Resource": "arn:*:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/AWSServiceRoleForFSxS3Access_*" } ] } } }, "createdDate": "2018-11-28T10:40:24.000Z", "lastUpdatedDate": "2018-11-28T10:40:24.000Z" }, "AmazonFSxReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonFSxReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-28T16:33:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "fsx:Describe*", "fsx:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-28T16:33:32.000Z", "lastUpdatedDate": "2018-11-28T16:33:32.000Z" }, "AmazonFSxFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonFSxFullAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2018-11-28T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "fsx:*" ], "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2021-06-08T12:05:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "fsx:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] } ] } }, "v3": { "createdDate": "2021-08-26T13:17:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "fsx:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2022-09-29T18:27:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "fsx:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2023-04-19T20:43:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "fsx:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2023-07-13T18:41:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2018-11-28T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ViewAWSDSDirectories", "Effect": "Allow", "Action": [ "ds:DescribeDirectories" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateSLRForFSx", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateLogsForFSxWindowsAuditLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Sid": "WriteToAmazonKinesisDataFirehose", "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "DescribeEC2VpcResources", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2018-11-28T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ViewAWSDSDirectories", "Effect": "Allow", "Action": [ "ds:DescribeDirectories" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateSLRForFSx", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateLogsForFSxWindowsAuditLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Sid": "WriteToAmazonKinesisDataFirehose", "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "DescribeEC2VpcResources", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "ManageCrossAccountDataReplication", "Effect": "Allow", "Action": [ "fsx:PutResourcePolicy", "fsx:GetResourcePolicy", "fsx:DeleteResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2018-11-28T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ViewAWSDSDirectories", "Effect": "Allow", "Action": [ "ds:DescribeDirectories" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateSLRForFSx", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateLogsForFSxWindowsAuditLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/fsx/*" ] }, { "Sid": "WriteToAmazonKinesisDataFirehose", "Effect": "Allow", "Action": [ "firehose:PutRecord" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-fsx-*" ] }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "DescribeEC2VpcResources", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "ManageCrossAccountDataReplication", "Effect": "Allow", "Action": [ "fsx:PutResourcePolicy", "fsx:GetResourcePolicy", "fsx:DeleteResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-28T16:34:43.000Z", "lastUpdatedDate": "2024-01-10T20:16:00.000Z" }, "AmazonFSxConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonFSxConsoleReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2018-11-28T16:35:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-06-08T12:21:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey", "logs:DescribeLogGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-10T13:17:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-09-22T14:07:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey", "logs:DescribeLogGroups" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2018-11-28T16:35:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "FSxReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey", "logs:DescribeLogGroups" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2018-11-28T16:35:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "FSxReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:Describe*", "fsx:ListTagsForResource", "kms:DescribeKey", "logs:DescribeLogGroups" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-28T16:35:24.000Z", "lastUpdatedDate": "2025-02-25T15:07:07.000Z" }, "AmazonFSxConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonFSxConsoleFullAccess", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2018-11-28T16:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "fsx:*", "kms:ListAliases", "s3:HeadBucket" ], "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2019-09-10T13:11:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "fsx:*", "kms:ListAliases", "s3:HeadBucket" ], "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2020-01-21T16:42:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "fsx:*", "kms:ListAliases", "s3:ListBucket" ], "Resource": "*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2021-06-08T12:14:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:*", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2021-08-26T13:18:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:*", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2022-09-22T14:08:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "fsx:*", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2023-07-13T18:44:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2018-11-28T16:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListResourcesAssociatedWithFSxFileSystem", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateFSxSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2018-11-28T16:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListResourcesAssociatedWithFSxFileSystem", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateFSxSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "ManageCrossAccountDataReplication", "Effect": "Allow", "Action": [ "fsx:PutResourcePolicy", "fsx:GetResourcePolicy", "fsx:DeleteResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2018-11-28T16:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListResourcesAssociatedWithFSxFileSystem", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateFSxSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "ManageCrossAccountDataReplication", "Effect": "Allow", "Action": [ "fsx:PutResourcePolicy", "fsx:GetResourcePolicy", "fsx:DeleteResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } }, "v12": { "createdDate": "2018-11-28T16:36:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListResourcesAssociatedWithFSxFileSystem", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "ds:DescribeDirectories", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "firehose:ListDeliveryStreams", "kms:ListAliases", "logs:DescribeLogGroups", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "FullAccessToFSx", "Effect": "Allow", "Action": [ "fsx:AssociateFileGateway", "fsx:AssociateFileSystemAliases", "fsx:CancelDataRepositoryTask", "fsx:CopyBackup", "fsx:CopySnapshotAndUpdateVolume", "fsx:CreateBackup", "fsx:CreateDataRepositoryAssociation", "fsx:CreateDataRepositoryTask", "fsx:CreateFileCache", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "fsx:CreateSnapshot", "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume", "fsx:CreateVolumeFromBackup", "fsx:DeleteBackup", "fsx:DeleteDataRepositoryAssociation", "fsx:DeleteFileCache", "fsx:DeleteFileSystem", "fsx:DeleteSnapshot", "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume", "fsx:DescribeAssociatedFileGateways", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeDataRepositoryTasks", "fsx:DescribeFileCaches", "fsx:DescribeFileSystemAliases", "fsx:DescribeFileSystems", "fsx:DescribeSharedVpcConfiguration", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:DisassociateFileGateway", "fsx:DisassociateFileSystemAliases", "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:ReleaseFileSystemNfsV3Locks", "fsx:RestoreVolumeFromSnapshot", "fsx:TagResource", "fsx:UntagResource", "fsx:UpdateDataRepositoryAssociation", "fsx:UpdateFileCache", "fsx:UpdateFileSystem", "fsx:UpdateSharedVpcConfiguration", "fsx:UpdateSnapshot", "fsx:UpdateStorageVirtualMachine", "fsx:UpdateVolume" ], "Resource": "*" }, { "Sid": "CreateFSxSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "fsx.amazonaws.com" ] } } }, { "Sid": "CreateSLRForLustreS3Integration", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "s3.data-source.lustre.fsx.amazonaws.com" ] } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AmazonFSx": "ManagedByAmazonFSx" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "fsx.amazonaws.com" ] } } }, { "Sid": "ManageCrossAccountDataReplication", "Effect": "Allow", "Action": [ "fsx:PutResourcePolicy", "fsx:GetResourcePolicy", "fsx:DeleteResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } } ] } } }, "createdDate": "2018-11-28T16:36:05.000Z", "lastUpdatedDate": "2025-02-07T19:22:06.000Z" }, "AmazonTextractFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTextractFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-28T19:07:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "textract:*" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-28T19:07:42.000Z", "lastUpdatedDate": "2018-11-28T19:07:42.000Z" }, "AmazonTextractServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonTextractServiceRole", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-28T19:12:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:AmazonTextract*" } ] } } }, "createdDate": "2018-11-28T19:12:16.000Z", "lastUpdatedDate": "2018-11-28T19:12:16.000Z" }, "AWSCloudMapReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudMapReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-28T23:45:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-11-28T23:45:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-28T23:45:26.000Z", "lastUpdatedDate": "2023-09-20T21:47:45.000Z" }, "AWSCloudMapFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudMapFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-28T23:57:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "ec2:DescribeVpcs", "ec2:DescribeRegions", "servicediscovery:*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-07-29T19:15:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "ec2:DescribeVpcs", "ec2:DescribeRegions", "ec2:DescribeInstances", "servicediscovery:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-28T23:57:31.000Z", "lastUpdatedDate": "2020-07-29T19:15:35.000Z" }, "AWSCloudMapDiscoverInstanceAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudMapDiscoverInstanceAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-29T00:02:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2018-11-29T00:02:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-29T00:02:42.000Z", "lastUpdatedDate": "2023-09-20T21:48:09.000Z" }, "AWSCloudMapRegisterInstanceAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudMapRegisterInstanceAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2018-11-29T00:04:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:DeregisterInstance", "servicediscovery:DiscoverInstances" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-07-29T17:57:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:DeregisterInstance", "servicediscovery:DiscoverInstances", "ec2:DescribeInstances" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2018-11-29T00:04:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListHostedZonesByName", "route53:ChangeResourceRecordSets", "route53:CreateHealthCheck", "route53:GetHealthCheck", "route53:DeleteHealthCheck", "route53:UpdateHealthCheck", "servicediscovery:Get*", "servicediscovery:List*", "servicediscovery:RegisterInstance", "servicediscovery:DeregisterInstance", "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision", "ec2:DescribeInstances" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-11-29T00:04:57.000Z", "lastUpdatedDate": "2023-09-20T21:47:06.000Z" }, "WellArchitectedConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/WellArchitectedConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-11-29T18:19:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "wellarchitected:*" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-29T18:19:23.000Z", "lastUpdatedDate": "2018-11-29T18:19:23.000Z" }, "WellArchitectedConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/WellArchitectedConsoleReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-11-29T18:21:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "wellarchitected:Get*", "wellarchitected:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-06-29T17:16:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "wellarchitected:Get*", "wellarchitected:List*", "wellarchitected:ExportLens" ], "Resource": "*" } ] } } }, "createdDate": "2018-11-29T18:21:08.000Z", "lastUpdatedDate": "2023-06-29T17:16:13.000Z" }, "CloudwatchApplicationInsightsServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudwatchApplicationInsightsServiceLinkedRolePolicy", "latestVersionId": "v25", "versionsCount": 25, "versions": { "v1": { "createdDate": "2018-12-01T16:22:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-04-24T17:25:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-05-24T18:26:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2019-06-05T01:47:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2019-06-24T18:54:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2019-11-01T01:06:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2020-03-13T19:39:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2020-06-02T19:50:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeStateMachine" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2020-07-13T17:19:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] } ] } }, "v12": { "createdDate": "2021-01-19T20:27:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] } ] } }, "v13": { "createdDate": "2021-04-15T00:30:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] } ] } }, "v10": { "createdDate": "2020-10-16T17:53:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] } ] } }, "v11": { "createdDate": "2020-11-09T22:39:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] } ] } }, "v14": { "createdDate": "2021-05-11T22:38:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups" ], "Resource": [ "*" ] } ] } }, "v16": { "createdDate": "2021-08-27T22:03:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2021-08-13T19:59:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ] } ] } }, "v18": { "createdDate": "2021-11-11T23:03:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" } ] } }, "v17": { "createdDate": "2021-09-22T22:35:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" } ] } }, "v20": { "createdDate": "2022-09-03T17:23:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] } ] } }, "v19": { "createdDate": "2022-01-25T17:51:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] } ] } }, "v21": { "createdDate": "2022-10-10T19:01:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": [ "*" ] } ] } }, "v22": { "createdDate": "2023-01-04T19:28:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListQueryLoggingConfigs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource": [ "*" ] } ] } }, "v24": { "createdDate": "2023-05-11T16:34:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources", "cloudFormation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:ListHealthChecks", "route53:ListQueryLoggingConfigs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource": [ "*" ] } ] } }, "v23": { "createdDate": "2023-01-23T21:38:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:ListHealthChecks", "route53:ListQueryLoggingConfigs" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource": [ "*" ] } ] } }, "v25": { "createdDate": "2018-12-01T16:22:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchLogs", "Effect": "Allow", "Action": [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "*" ] }, { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": [ "*" ] }, { "Sid": "CloudFormation", "Effect": "Allow", "Action": [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources", "cloudFormation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Sid": "CloudFormationStacks", "Effect": "Allow", "Action": [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources", "cloudFormation:ListStacks" ], "Resource": [ "*" ] }, { "Sid": "Tag", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ] }, { "Sid": "ResourceGroups", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource": [ "*" ] }, { "Sid": "ApplicationInsightsResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource": [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Sid": "ElasticLoadBalancing", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ] }, { "Sid": "SSMParameter", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Sid": "SSMAssociation", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid": "SSMOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ] }, { "Sid": "SSMTags", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "SSMGetCommandInvocation", "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Sid": "SSMSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource": [ "*" ] }, { "Sid": "RDS", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": [ "*" ] }, { "Sid": "Lambda", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource": [ "*" ] }, { "Sid": "EventBridgeManagedRule", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Sid": "XRay", "Effect": "Allow", "Action": [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource": [ "*" ] }, { "Sid": "DynamoDB", "Effect": "Allow", "Action": [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource": [ "*" ] }, { "Sid": "ApplicationAutoscaling", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "*" ] }, { "Sid": "S3", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "*" ] }, { "Sid": "States", "Effect": "Allow", "Action": [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource": [ "*" ] }, { "Sid": "APIGateway", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "*" ] }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource": [ "*" ] }, { "Sid": "ECSCluster", "Effect": "Allow", "Action": [ "ecs:UpdateClusterSettings" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Sid": "EKS", "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource": [ "*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource": [ "*" ] }, { "Sid": "SQS", "Effect": "Allow", "Action": [ "sqs:ListQueues" ], "Resource": "*" }, { "Sid": "CloudWatchLogsDeleteSubscriptionFilter", "Effect": "Allow", "Action": [ "logs:DeleteSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Sid": "CloudWatchLogsCreateSubscriptionFilter", "Effect": "Allow", "Action": [ "logs:PutSubscriptionFilter" ], "Resource": [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Sid": "EFS", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": [ "*" ] }, { "Sid": "Route53", "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:ListHealthChecks", "route53:ListQueryLoggingConfigs" ], "Resource": [ "*" ] }, { "Sid": "Route53Resolver", "Effect": "Allow", "Action": [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2018-12-01T16:22:12.000Z", "lastUpdatedDate": "2024-07-25T16:24:03.000Z" }, "AWSIoTSiteWiseFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTSiteWiseFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-12-04T20:53:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:*" ], "Resource": "*" } ] } } }, "createdDate": "2018-12-04T20:53:39.000Z", "lastUpdatedDate": "2018-12-04T20:53:39.000Z" }, "AWSIoTSiteWiseReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTSiteWiseReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-12-04T20:55:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:Describe*", "iotsitewise:List*", "iotsitewise:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-09-16T19:05:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:Describe*", "iotsitewise:List*", "iotsitewise:Get*", "iotsitewise:BatchGet*" ], "Resource": "*" } ] } } }, "createdDate": "2018-12-04T20:55:11.000Z", "lastUpdatedDate": "2022-09-16T19:05:20.000Z" }, "AmazonPersonalizeFullAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonPersonalizeFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-12-04T22:24:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "personalize:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*Personalize*", "arn:aws:s3:::*personalize*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "personalize.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2019-05-30T23:46:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "personalize:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*Personalize*", "arn:aws:s3:::*personalize*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "personalize.amazonaws.com" } } } ] } } }, "createdDate": "2018-12-04T22:24:33.000Z", "lastUpdatedDate": "2019-05-30T23:46:59.000Z" }, "ClientVPNServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ClientVPNServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2018-12-10T21:20:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ds:AuthorizeApplication", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "acm:GetCertificate" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-01-16T22:22:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAccountAttributes", "ds:AuthorizeApplication", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:ListAuthorizedApplications", "ds:UnauthorizeApplication", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "acm:GetCertificate", "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-06T18:51:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAccountAttributes", "ds:AuthorizeApplication", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:UnauthorizeApplication", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "acm:GetCertificate", "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-03-18T18:29:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAccountAttributes", "ds:AuthorizeApplication", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:UnauthorizeApplication", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "acm:GetCertificate", "acm:DescribeCertificate", "iam:GetSAMLProvider" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-08-12T19:39:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAccountAttributes", "ds:AuthorizeApplication", "ds:DescribeDirectories", "ds:GetDirectoryLimits", "ds:UnauthorizeApplication", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "acm:GetCertificate", "acm:DescribeCertificate", "iam:GetSAMLProvider", "lambda:GetFunctionConfiguration" ], "Resource": "*" } ] } } }, "createdDate": "2018-12-10T21:20:25.000Z", "lastUpdatedDate": "2020-08-12T19:39:34.000Z" }, "AmazonMQApiReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMQApiReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2018-12-18T20:31:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "mq:Describe*", "mq:List*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2018-12-18T20:31:13.000Z", "lastUpdatedDate": "2018-12-18T20:31:13.000Z" }, "AmazonMQApiFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMQApiFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2018-12-18T20:31:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mq:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] } ] } }, "v2": { "createdDate": "2020-11-04T16:45:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mq:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DetachNetworkInterface", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "mq.amazonaws.com" } } } ] } } }, "createdDate": "2018-12-18T20:31:31.000Z", "lastUpdatedDate": "2020-11-04T16:45:35.000Z" }, "AmazonDocDBFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDocDBFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-09T20:21:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } } }, "createdDate": "2019-01-09T20:21:44.000Z", "lastUpdatedDate": "2019-01-09T20:21:44.000Z" }, "AmazonDocDBReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDocDBReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-09T20:30:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSubnetGroups", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DownloadDBLogFilePortion", "rds:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:ListRetirableGrants", "kms:ListAliases", "kms:ListKeyPolicies" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/docdb/*:log-stream:*" ] } ] } } }, "createdDate": "2019-01-09T20:30:28.000Z", "lastUpdatedDate": "2019-01-09T20:30:28.000Z" }, "AmazonDocDBConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDocDBConsoleFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2019-01-09T20:37:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListKeysForService", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2019-10-21T18:57:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2021-04-05T22:42:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-11-30T15:23:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource", "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:CreateGlobalCluster", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DeleteGlobalCluster", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:ModifyGlobalCluster", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveFromGlobalCluster", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2019-01-09T20:37:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DocdbSids", "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource", "docdb-elastic:CopyClusterSnapshot", "docdb-elastic:StartCluster", "docdb-elastic:StopCluster", "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:CreateGlobalCluster", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DeleteGlobalCluster", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:ModifyGlobalCluster", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveFromGlobalCluster", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Resource": [ "*" ] }, { "Sid": "DependencySids", "Effect": "Allow", "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Resource": [ "*" ] }, { "Sid": "DocdbSLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Sid": "DocdbElasticSLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2019-01-09T20:37:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DocdbSids", "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource", "docdb-elastic:CopyClusterSnapshot", "docdb-elastic:StartCluster", "docdb-elastic:StopCluster", "docdb-elastic:GetPendingMaintenanceAction", "docdb-elastic:ListPendingMaintenanceActions", "docdb-elastic:ApplyPendingMaintenanceAction", "rds:AddRoleToDBCluster", "rds:AddSourceIdentifierToSubscription", "rds:AddTagsToResource", "rds:ApplyPendingMaintenanceAction", "rds:CopyDBClusterParameterGroup", "rds:CopyDBClusterSnapshot", "rds:CopyDBParameterGroup", "rds:CreateDBCluster", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBParameterGroup", "rds:CreateDBSubnetGroup", "rds:CreateEventSubscription", "rds:CreateGlobalCluster", "rds:DeleteDBCluster", "rds:DeleteDBClusterParameterGroup", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBInstance", "rds:DeleteDBParameterGroup", "rds:DeleteDBSubnetGroup", "rds:DeleteEventSubscription", "rds:DeleteGlobalCluster", "rds:DescribeAccountAttributes", "rds:DescribeCertificates", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBLogFiles", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventCategories", "rds:DescribeEventSubscriptions", "rds:DescribeEvents", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribePendingMaintenanceActions", "rds:DescribeValidDBInstanceModifications", "rds:DownloadDBLogFilePortion", "rds:FailoverDBCluster", "rds:ListTagsForResource", "rds:ModifyDBCluster", "rds:ModifyDBClusterParameterGroup", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBInstance", "rds:ModifyDBParameterGroup", "rds:ModifyDBSubnetGroup", "rds:ModifyEventSubscription", "rds:ModifyGlobalCluster", "rds:PromoteReadReplicaDBCluster", "rds:RebootDBInstance", "rds:RemoveFromGlobalCluster", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:ResetDBParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime" ], "Resource": [ "*" ] }, { "Sid": "DependencySids", "Effect": "Allow", "Action": [ "iam:GetRole", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:AllocateAddress", "ec2:AssignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AssociateSubnetCidrBlock", "ec2:AssociateVpcCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:CreateCustomerGateway", "ec2:CreateDefaultSubnet", "ec2:CreateDefaultVpc", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:ListRetirableGrants", "logs:DescribeLogStreams", "logs:GetLogEvents", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish" ], "Resource": [ "*" ] }, { "Sid": "DocdbSLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Condition": { "StringLike": { "iam:AWSServiceName": "rds.amazonaws.com" } } }, { "Sid": "DocdbElasticSLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } } }, "createdDate": "2019-01-09T20:37:28.000Z", "lastUpdatedDate": "2025-02-11T18:22:07.000Z" }, "AWSBackupServiceRolePolicyForBackup": { "arn": "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "latestVersionId": "v21", "versionsCount": 21, "versions": { "v2": { "createdDate": "2019-04-25T19:15:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v1": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2019-06-25T20:26:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v4": { "createdDate": "2020-01-13T16:02:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v5": { "createdDate": "2020-06-03T07:06:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v7": { "createdDate": "2020-11-09T16:50:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault", "backup:CopyFromBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" } ] } }, "v6": { "createdDate": "2020-09-14T22:33:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v8": { "createdDate": "2020-11-18T23:16:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" } ] } }, "v9": { "createdDate": "2021-03-10T18:32:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" } ] } }, "v10": { "createdDate": "2021-04-12T18:07:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" } ] } }, "v11": { "createdDate": "2021-11-23T22:00:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" } ] } }, "v13": { "createdDate": "2022-10-12T22:14:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] } ] } }, "v12": { "createdDate": "2022-05-17T17:31:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" } ] } }, "v15": { "createdDate": "2023-04-24T21:27:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v14": { "createdDate": "2022-11-10T22:38:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v16": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v17": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "DynamoDBBackupPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RDSModifyPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "RDSClusterBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Sid": "RDSBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Sid": "RDSClusterModifyPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Sid": "EBSTagAndDeletePermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource": "*" }, { "Sid": "EC2TagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EBSSnapshotTierPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotTier", "ec2:DescribeSnapshotTierStatus" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "BackupVaultPermissions", "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Sid": "BackupVaultCopyPermissions", "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EBSResourcePermissions", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "KMSDynamoDBPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSDataKeyEC2Permissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Sid": "GetResourcesPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMSendPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxCreateBackupPermissions", "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxListTagsPermissions", "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxResourcePermissions", "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "RedshiftCreatePermissions", "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftResourcePermissions", "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SSMSAPResourcePermissions", "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v18": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "DynamoDBBackupPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RDSModifyPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "RDSClusterBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Sid": "RDSBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Sid": "RDSClusterModifyPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Sid": "EBSTagAndDeletePermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "EC2TagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EBSSnapshotTierPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "BackupVaultPermissions", "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Sid": "BackupVaultCopyPermissions", "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EBSResourcePermissions", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "KMSDynamoDBPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSDataKeyEC2Permissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Sid": "GetResourcesPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMSendPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxCreateBackupPermissions", "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxListTagsPermissions", "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxResourcePermissions", "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "RedshiftCreatePermissions", "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftResourcePermissions", "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SSMSAPResourcePermissions", "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v19": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "DynamoDBBackupPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RDSModifyPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "RDSClusterBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Sid": "RDSBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Sid": "RDSClusterModifyPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Sid": "EBSTagAndDeletePermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "EC2TagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EBSSnapshotTierPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "BackupVaultPermissions", "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Sid": "BackupVaultCopyPermissions", "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EBSResourcePermissions", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "KMSDynamoDBPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSDataKeyEC2Permissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Sid": "GetResourcesPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMSendPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxCreateBackupPermissions", "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxListTagsPermissions", "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxResourcePermissions", "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "RedshiftCreatePermissions", "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftResourcePermissions", "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SSMSAPResourcePermissions", "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } }, "v20": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "DynamoDBBackupPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RDSInstanceAutomatedBackupPermissions", "Effect": "Allow", "Action": "rds:DeleteDBInstanceAutomatedBackup", "Resource": "arn:aws:rds:*:*:auto-backup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "RDSClusterBackupPermissions", "Effect": "Allow", "Action": "rds:DeleteDBClusterAutomatedBackup", "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Sid": "RDSModifyPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "RDSBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Sid": "RDSClusterModifyPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Sid": "EBSTagAndDeletePermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "EC2TagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EBSSnapshotTierPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "BackupVaultPermissions", "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Sid": "BackupVaultCopyPermissions", "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EBSResourcePermissions", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "KMSDynamoDBPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSDataKeyEC2Permissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Sid": "GetResourcesPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMSendPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxCreateBackupPermissions", "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxListTagsPermissions", "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxResourcePermissions", "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "RedshiftCreatePermissions", "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftResourcePermissions", "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SSMSAPResourcePermissions", "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } }, "v21": { "createdDate": "2019-01-10T21:01:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "DynamoDBBackupPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RDSInstanceAutomatedBackupPermissions", "Effect": "Allow", "Action": "rds:DeleteDBInstanceAutomatedBackup", "Resource": "arn:aws:rds:*:*:auto-backup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "RDSClusterBackupPermissions", "Effect": "Allow", "Action": "rds:DeleteDBClusterAutomatedBackup", "Resource": "arn:aws:rds:*:*:cluster-auto-backup:*" }, { "Sid": "RDSModifyPermissions", "Effect": "Allow", "Action": [ "rds:ModifyDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "RDSBackupPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Sid": "RDSClusterModifyPermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopySnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": "*" }, { "Sid": "EBSTagAndDeletePermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "EC2TagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:image/*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:ModifyImageAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EBSSnapshotTierPermissions", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "BackupVaultPermissions", "Effect": "Allow", "Action": [ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource": "arn:aws:backup:*:*:backup-vault:*" }, { "Sid": "BackupVaultCopyPermissions", "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EBSResourcePermissions", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "KMSDynamoDBPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSDataKeyEC2Permissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Sid": "GetResourcesPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMSendPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxCreateBackupPermissions", "Effect": "Allow", "Action": "fsx:CreateBackup", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxListTagsPermissions", "Effect": "Allow", "Action": "fsx:ListTagsForResource", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxResourcePermissions", "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamodbBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:StartAwsBackupJob", "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "BackupGatewayBackupPermissions", "Effect": "Allow", "Action": [ "backup-gateway:Backup", "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:GetTemplate", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "RedshiftCreatePermissions", "Effect": "Allow", "Action": [ "redshift:CreateClusterSnapshot", "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftResourcePermissions", "Effect": "Allow", "Action": [ "redshift:CreateTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftServerlessCreatePermissions", "Effect": "Allow", "Action": [ "redshift-serverless:CreateSnapshot" ], "Resource": [ "arn:aws:redshift-serverless:*:*:snapshot/*", "arn:aws:redshift-serverless:*:*:namespace/*" ] }, { "Sid": "RedshiftServerlessSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:DeleteSnapshot" ], "Resource": [ "arn:aws:redshift-serverless:*:*:snapshot/*" ], "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "RedshiftServerlessGetPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ] }, { "Sid": "RedshiftServerlessResourcePermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetSnapshot", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "RedshiftServerlessListPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTagsForResource" ], "Resource": [ "*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsBackupJob", "timestream:GetAwsBackupStatus", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListTagsForResource", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SSMSAPResourcePermissions", "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2019-01-10T21:01:28.000Z", "lastUpdatedDate": "2025-03-27T21:52:06.000Z" }, "AWSIoTEventsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTEventsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-01-10T22:50:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotevents:Describe*", "iotevents:List*", "iotevents:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-23T17:22:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotevents:Describe*", "iotevents:List*" ], "Resource": "*" } ] } } }, "createdDate": "2019-01-10T22:50:08.000Z", "lastUpdatedDate": "2019-09-23T17:22:04.000Z" }, "AWSIoTEventsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTEventsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-10T22:51:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotevents:*" ], "Resource": "*" } ] } } }, "createdDate": "2019-01-10T22:51:57.000Z", "lastUpdatedDate": "2019-01-10T22:51:57.000Z" }, "AWSElasticBeanstalkMaintenance": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticBeanstalkMaintenance", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-01-11T23:22:52.000Z", "document": { "Version": "2012-10-17", "Statement": { "Sid": "AllowCloudformationChangeSetOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, "v2": { "createdDate": "2019-06-04T17:48:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationChangeSetOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowElasticBeanstalkStacksUpdateExecuteSuccessfully", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" } ] } }, "v3": { "createdDate": "2019-01-11T23:22:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCloudformationChangeSetOperationsOnElasticBeanstalkStacks", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ListChangeSets", "cloudformation:DescribeStacks", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "AllowElasticBeanstalkStacksUpdateExecuteSuccessfully", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" } ] } } }, "createdDate": "2019-01-11T23:22:52.000Z", "lastUpdatedDate": "2024-04-29T21:48:04.000Z" }, "AWSBackupServiceRolePolicyForRestores": { "arn": "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", "latestVersionId": "v22", "versionsCount": 22, "versions": { "v1": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" } ] } }, "v3": { "createdDate": "2019-04-25T19:17:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } } ] } }, "v2": { "createdDate": "2019-01-14T19:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" } ] } }, "v4": { "createdDate": "2019-10-03T19:10:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } } ] } }, "v5": { "createdDate": "2020-01-13T16:04:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "ec2:RunInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "arn:aws:ec2:*:*:instance/*" } ] } }, "v6": { "createdDate": "2020-05-29T21:48:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "ec2:RunInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "arn:aws:ec2:*:*:instance/*" } ] } }, "v7": { "createdDate": "2020-11-09T16:52:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "ec2:RunInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": [ "fsx:CreateFileSystemFromBackup" ], "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2021-05-25T00:02:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" } ] } }, "v8": { "createdDate": "2021-03-10T18:30:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*", "Effect": "Allow" }, { "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Action": "kms:DescribeKey", "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Action": "kms:CreateGrant", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Action": [ "ec2:RunInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": [ "fsx:CreateFileSystemFromBackup" ], "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v10": { "createdDate": "2021-11-23T22:00:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" } ] } }, "v11": { "createdDate": "2022-03-31T18:21:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" } ] } }, "v12": { "createdDate": "2022-05-17T17:36:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" } ] } }, "v13": { "createdDate": "2022-07-19T23:22:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" } ] } }, "v14": { "createdDate": "2022-10-12T22:12:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2022-11-10T22:45:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v16": { "createdDate": "2023-03-28T23:32:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v17": { "createdDate": "2023-04-24T21:24:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAnyValue:StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v18": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime", "rds:DescribeDBClusterSnapshots", "rds:RestoreDBClusterToPointInTime" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAnyValue:StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v19": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "EBSPermissions", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "EC2DescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayListPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "RDSPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime", "rds:DescribeDBClusterSnapshots", "rds:RestoreDBClusterToPointInTime" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "EBSSnapshotBlockPermissions", "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "RDSResourcePermissions", "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Sid": "EC2DeleteAndRestorePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:RestoreSnapshotTier", "ec2:DescribeSnapshotTierStatus" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EC2CreateTagsScopedPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "EC2RunInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Sid": "EC2TerminateInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAnyValue:StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Sid": "FsxTagPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "FsxDescribePermissions", "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxVolumeTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "FsxBackupTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "DSPermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "CloudformationChangeSetPermissions", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftTablePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v20": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "EBSPermissions", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "EC2DescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayListPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "RDSPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime", "rds:DescribeDBClusterSnapshots", "rds:RestoreDBClusterToPointInTime" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "EBSSnapshotBlockPermissions", "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "RDSResourcePermissions", "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Sid": "EC2DeleteAndRestorePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:RestoreSnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EC2CreateTagsScopedPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "EC2RunInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Sid": "EC2TerminateInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAnyValue:StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Sid": "FsxTagPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "FsxDescribePermissions", "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxVolumeTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "FsxBackupTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "DSPermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "CloudformationChangeSetPermissions", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftTablePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v21": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "EBSPermissions", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "EC2DescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayListPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "RDSPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime", "rds:DescribeDBClusterSnapshots", "rds:RestoreDBClusterToPointInTime", "rds:CreateTenantDatabase", "rds:DeleteTenantDatabase" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "EBSSnapshotBlockPermissions", "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "RDSResourcePermissions", "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Sid": "EC2DeleteAndRestorePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:RestoreSnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EC2CreateTagsScopedPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "EC2RunInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Sid": "EC2TerminateInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAnyValue:StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Sid": "FsxTagPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "FsxDescribePermissions", "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxVolumeTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "FsxBackupTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "DSPermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "CloudformationChangeSetPermissions", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftTablePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } }, "v22": { "createdDate": "2019-01-12T00:23:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "DynamoDBBackupResourcePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "EBSPermissions", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "EC2DescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInternetGateways", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes", "storagegateway:AddTagsToResource" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayListPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "RDSPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:DeleteDBCluster", "rds:RestoreDBInstanceToPointInTime", "rds:DescribeDBClusterSnapshots", "rds:RestoreDBClusterToPointInTime", "rds:CreateTenantDatabase", "rds:DeleteTenantDatabase" ], "Resource": "*" }, { "Sid": "EFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com", "ec2.*.amazonaws.com", "elasticfilesystem.*.amazonaws.com", "rds.*.amazonaws.com", "redshift.*.amazonaws.com", "redshift-serverless.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "EBSSnapshotBlockPermissions", "Effect": "Allow", "Action": [ "ebs:CompleteSnapshot", "ebs:StartSnapshot", "ebs:PutSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "RDSResourcePermissions", "Effect": "Allow", "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Sid": "EC2DeleteAndRestorePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:RestoreSnapshotTier" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "EC2CreateTagsScopedPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "EC2RunInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Sid": "EC2TerminateInstancesPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "ec2:CreateAction": [ "RunInstances", "CreateVolume" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CreateFileSystemFromBackup" ], "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Sid": "FsxTagPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FsxBackupPermissions", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "FsxDescribePermissions", "Effect": "Allow", "Action": [ "fsx:DescribeVolumes" ], "Resource": "arn:aws:fsx:*:*:volume/*" }, { "Sid": "FsxVolumeTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws:backup:source-resource" ] } } }, { "Sid": "FsxBackupTagPermissions", "Effect": "Allow", "Action": [ "fsx:CreateVolumeFromBackup", "fsx:TagResource" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*" ] }, { "Sid": "FsxVolumePermissions", "Effect": "Allow", "Action": [ "fsx:DeleteVolume", "fsx:UntagResource" ], "Resource": "arn:aws:fsx:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "DSPermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "DynamoDBRestorePermissions", "Effect": "Allow", "Action": [ "dynamodb:RestoreTableFromAwsBackup" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "GatewayRestorePermissions", "Effect": "Allow", "Action": [ "backup-gateway:Restore" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "CloudformationChangeSetPermissions", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:*/*/*" }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:RestoreFromClusterSnapshot", "redshift:RestoreTableFromClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftTablePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeTableRestoreStatus" ], "Resource": "*" }, { "Sid": "RedshiftServerlessSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:RestoreTableFromSnapshot" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "RedshiftServerlessNamespacePermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ] }, { "Sid": "RedshiftServerlessTablePermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetTableRestoreStatus" ], "Resource": [ "*" ] }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:StartAwsRestoreJob", "timestream:GetAwsRestoreStatus", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:ListDatabases", "timestream:DescribeTable", "timestream:DescribeDatabase" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamEndpointPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-01-12T00:23:54.000Z", "lastUpdatedDate": "2025-03-27T21:52:06.000Z" }, "AWSTransferLoggingAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-14T15:32:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2019-01-14T15:32:50.000Z", "lastUpdatedDate": "2019-01-14T15:32:50.000Z" }, "AmazonMSKFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2019-01-14T22:07:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "kms:DescribeKey", "kms:CreateGrant" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringLike": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*" } ] } }, "v2": { "createdDate": "2020-02-28T01:16:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringLike": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*" } ] } }, "v3": { "createdDate": "2020-03-14T00:45:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "S3:GetBucketPolicy", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "firehose:TagDeliveryStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringLike": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery*", "Condition": { "StringLike": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2021-11-30T18:04:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcAttribute", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "S3:GetBucketPolicy", "firehose:TagDeliveryStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc/*", "arn:*:ec2:*:*:subnet/*", "arn:*:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AWSMSKManaged": "true" }, "StringLike": { "aws:RequestTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSMSKManaged": "true" }, "StringLike": { "ec2:ResourceTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringLike": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery*", "Condition": { "StringLike": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2021-11-18T21:26:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "S3:GetBucketPolicy", "firehose:TagDeliveryStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringLike": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery*", "Condition": { "StringLike": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2022-01-06T21:18:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcAttribute", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "S3:GetBucketPolicy", "firehose:TagDeliveryStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc/*", "arn:*:ec2:*:*:subnet/*", "arn:*:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AWSMSKManaged": "true" }, "StringLike": { "aws:RequestTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSMSKManaged": "true" }, "StringLike": { "ec2:ResourceTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringEquals": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery*", "Condition": { "StringEquals": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2019-01-14T22:07:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:*", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcAttribute", "kms:DescribeKey", "kms:CreateGrant", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "S3:GetBucketPolicy", "firehose:TagDeliveryStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc/*", "arn:*:ec2:*:*:subnet/*", "arn:*:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:*:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AWSMSKManaged": "true" }, "StringLike": { "aws:RequestTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSMSKManaged": "true" }, "StringLike": { "ec2:ResourceTag/ClusterArn": "*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", "Condition": { "StringEquals": { "iam:AWSServiceName": "kafka.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery*", "Condition": { "StringEquals": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } } ] } } }, "createdDate": "2019-01-14T22:07:52.000Z", "lastUpdatedDate": "2023-10-18T11:33:13.000Z" }, "AmazonMSKReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-14T22:28:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "kafka:Describe*", "kafka:List*", "kafka:Get*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-01-14T22:28:45.000Z", "lastUpdatedDate": "2019-01-14T22:28:45.000Z" }, "AmazonForecastFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonForecastFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-18T01:52:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "forecast:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } } ] } } }, "createdDate": "2019-01-18T01:52:29.000Z", "lastUpdatedDate": "2019-01-18T01:52:29.000Z" }, "AWSDataSyncReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataSyncReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-01-18T19:18:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:Describe*", "datasync:List*", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-01-24T17:59:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:Describe*", "datasync:List*", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "iam:GetRole", "iam:ListRoles", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-06-30T17:59:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:Describe*", "datasync:List*", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "iam:GetRole", "iam:ListRoles", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" } ] } } }, "createdDate": "2019-01-18T19:18:44.000Z", "lastUpdatedDate": "2020-06-30T17:59:22.000Z" }, "AWSDataSyncFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataSyncFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v2": { "createdDate": "2020-01-24T17:59:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v1": { "createdDate": "2019-01-18T19:40:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2023-05-02T16:37:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "fsx:DescribeStorageVirtualMachines", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "outposts:ListOutposts", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3-outposts:ListAccessPoints", "s3-outposts:ListRegionalBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2020-06-30T17:58:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2019-01-18T19:40:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataSyncFullAccessPermissions", "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "fsx:DescribeStorageVirtualMachines", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "outposts:ListOutposts", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3-outposts:ListAccessPoints", "s3-outposts:ListRegionalBuckets" ], "Resource": "*" }, { "Sid": "DataSyncPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2019-01-18T19:40:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataSyncFullAccessPermissions", "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "fsx:DescribeStorageVirtualMachines", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "outposts:ListOutposts", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3-outposts:ListAccessPoints", "s3-outposts:ListRegionalBuckets" ], "Resource": "*" }, { "Sid": "DataSyncPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2019-01-18T19:40:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataSyncFullAccessPermissions", "Effect": "Allow", "Action": [ "datasync:*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:ModifyNetworkInterfaceAttribute", "fsx:DescribeFileSystems", "fsx:DescribeStorageVirtualMachines", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "iam:GetRole", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "outposts:ListOutposts", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3-outposts:ListAccessPoints", "s3-outposts:ListRegionalBuckets" ], "Resource": "*" }, { "Sid": "DataSyncPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "datasync.amazonaws.com" ] } } }, { "Sid": "DataSyncCreateSLRPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/datasync.amazonaws.com/AWSServiceRoleForDataSync", "Condition": { "StringEquals": { "iam:AWSServiceName": "datasync.amazonaws.com" } } } ] } } }, "createdDate": "2019-01-18T19:40:36.000Z", "lastUpdatedDate": "2024-10-18T20:07:03.000Z" }, "WorkLinkServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/WorkLinkServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-01-23T19:03:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateNetworkInterfacePermission", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords" ], "Resource": "arn:aws:kinesis:*:*:stream/AmazonWorkLink-*" } ] } } }, "createdDate": "2019-01-23T19:03:45.000Z", "lastUpdatedDate": "2019-01-23T19:03:45.000Z" }, "AWSDeepRacerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSDeepRacerServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-02-28T21:58:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "deepracer:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:CreateStack", "cloudformation:DeleteStack", "robomaker:*", "sagemaker:*", "sts:*", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } }, "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepRacer*", "arn:aws:iam::*:role/service-role/AWSDeepRacer*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*DeepRacer*", "arn:aws:lambda:*:*:function:*Deepracer*", "arn:aws:lambda:*:*:function:*deepracer*", "arn:aws:lambda:*:*:function:*dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketLocation", "s3:DeleteObject", "s3:ListBucket", "s3:PutObject", "s3:PutBucketPolicy", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*", "arn:aws:s3:::dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/DeepRacer": "true" } } }, { "Effect": "Allow", "Action": [ "kinesisvideo:CreateStream", "kinesisvideo:DeleteStream", "kinesisvideo:DescribeStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:TagStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/dr-*" ] } ] } }, "v3": { "createdDate": "2019-06-12T20:55:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "deepracer:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "robomaker:*", "sagemaker:*", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStackEvents", "cloudformation:DetectStackDrift", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:DescribeStackResourceDrifts" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } }, "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepRacer*", "arn:aws:iam::*:role/service-role/AWSDeepRacer*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*DeepRacer*", "arn:aws:lambda:*:*:function:*Deepracer*", "arn:aws:lambda:*:*:function:*deepracer*", "arn:aws:lambda:*:*:function:*dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketLocation", "s3:DeleteObject", "s3:ListBucket", "s3:PutObject", "s3:PutBucketPolicy", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*", "arn:aws:s3:::dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/DeepRacer": "true" } } }, { "Effect": "Allow", "Action": [ "kinesisvideo:CreateStream", "kinesisvideo:DeleteStream", "kinesisvideo:DescribeStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:GetHLSStreamingSessionURL", "kinesisvideo:GetMedia", "kinesisvideo:PutMedia", "kinesisvideo:TagStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/dr-*" ] } ] } }, "v2": { "createdDate": "2019-04-06T04:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "deepracer:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "robomaker:*", "sagemaker:*", "sts:*", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStackEvents", "cloudformation:DetectStackDrift", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:DescribeStackResourceDrifts" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } }, "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSDeepRacer*", "arn:aws:iam::*:role/service-role/AWSDeepRacer*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*DeepRacer*", "arn:aws:lambda:*:*:function:*Deepracer*", "arn:aws:lambda:*:*:function:*deepracer*", "arn:aws:lambda:*:*:function:*dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketLocation", "s3:DeleteObject", "s3:ListBucket", "s3:PutObject", "s3:PutBucketPolicy", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*", "arn:aws:s3:::dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/DeepRacer": "true" } } }, { "Effect": "Allow", "Action": [ "kinesisvideo:CreateStream", "kinesisvideo:DeleteStream", "kinesisvideo:DescribeStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:GetHLSStreamingSessionURL", "kinesisvideo:GetMedia", "kinesisvideo:PutMedia", "kinesisvideo:TagStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/dr-*" ] } ] } } }, "createdDate": "2019-02-28T21:58:09.000Z", "lastUpdatedDate": "2019-06-12T20:55:34.000Z" }, "AWSDeepRacerCloudFormationAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AWSDeepRacerCloudFormationAccessPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-02-28T21:59:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AttachInternetGateway", "ec2:AssociateRouteTable", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteInternetGateway", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifyVpcAttribute", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-14T17:02:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AttachInternetGateway", "ec2:AssociateRouteTable", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateNetworkAcl", "ec2:CreateNetworkAclEntry", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DeleteInternetGateway", "ec2:DeleteNatGateway", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkAclEntry", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteTags", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoints", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ReleaseAddress", "ec2:ReplaceNetworkAclAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AWSDeepRacerLambdaAccessRole", "Condition": { "StringLikeIfExists": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:GetFunction", "lambda:DeleteFunction", "lambda:TagResource", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*DeepRacer*", "arn:aws:lambda:*:*:function:*Deepracer*", "arn:aws:lambda:*:*:function:*deepracer*" ] }, { "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:CreateBucket", "s3:ListBucket", "s3:GetBucketAcl", "s3:DeleteBucket" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*" ] }, { "Effect": "Allow", "Action": [ "robomaker:CreateSimulationApplication", "robomaker:CreateSimulationApplicationVersion", "robomaker:DeleteSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListSimulationApplications", "robomaker:TagResource", "robomaker:UpdateSimulationApplication" ], "Resource": [ "arn:aws:robomaker:*:*:/createSimulationApplication", "arn:aws:robomaker:*:*:simulation-application/deepracer*" ] } ] } } }, "createdDate": "2019-02-28T21:59:49.000Z", "lastUpdatedDate": "2019-06-14T17:02:04.000Z" }, "AWSDeepRacerRoboMakerAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AWSDeepRacerRoboMakerAccessPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-02-28T21:59:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "robomaker:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/robomaker/SimulationJobs", "arn:aws:logs:*:*:log-group:/aws/robomaker/SimulationJobs:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*", "arn:aws:s3:::dr-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/DeepRacer": "true" } } }, { "Effect": "Allow", "Action": [ "kinesisvideo:CreateStream", "kinesisvideo:DescribeStream", "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:TagStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/dr-*" ] } ] } } }, "createdDate": "2019-02-28T21:59:58.000Z", "lastUpdatedDate": "2019-02-28T21:59:58.000Z" }, "ComprehendDataAccessRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ComprehendDataAccessRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-03-06T22:28:15.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*Comprehend*", "arn:aws:s3:::*comprehend*" ] } } } }, "createdDate": "2019-03-06T22:28:15.000Z", "lastUpdatedDate": "2019-03-06T22:28:15.000Z" }, "AlexaForBusinessNetworkProfileServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AlexaForBusinessNetworkProfileServicePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-03-13T00:53:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "A4bPcaTagAccess", "Action": [ "acm-pca:GetCertificate", "acm-pca:IssueCertificate", "acm-pca:RevokeCertificate" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/a4b": "enabled" } } } ] } }, "v2": { "createdDate": "2019-04-05T21:57:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "A4bPcaTagAccess", "Action": [ "acm-pca:GetCertificate", "acm-pca:IssueCertificate", "acm-pca:RevokeCertificate" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/a4b": "enabled" } } }, { "Sid": "A4bNetworkProfileAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:A4BNetworkProfile*" } ] } } }, "createdDate": "2019-03-13T00:53:40.000Z", "lastUpdatedDate": "2019-04-05T21:57:56.000Z" }, "AmazonSSMManagedInstanceCore": { "arn": "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-03-15T17:22:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-23T16:54:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" } ] } } }, "createdDate": "2019-03-15T17:22:12.000Z", "lastUpdatedDate": "2019-05-23T16:54:21.000Z" }, "AmazonSSMDirectoryServiceAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-03-15T17:44:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource": "*" } ] } } }, "createdDate": "2019-03-15T17:44:38.000Z", "lastUpdatedDate": "2019-03-15T17:44:38.000Z" }, "AmazonCognitoIdpEmailServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonCognitoIdpEmailServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-03-21T21:32:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "ses:List*" ], "Resource": "*" } ] } } }, "createdDate": "2019-03-21T21:32:25.000Z", "lastUpdatedDate": "2019-03-21T21:32:25.000Z" }, "AWSIQFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIQFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-04-04T23:13:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iq:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-25T20:22:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iq:*", "iq-permission:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "permission.iq.amazonaws.com", "contract.iq.amazonaws.com" ] } } } ] } } }, "createdDate": "2019-04-04T23:13:42.000Z", "lastUpdatedDate": "2019-09-25T20:22:34.000Z" }, "AWSGlobalAcceleratorSLRPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v2": { "createdDate": "2019-09-06T17:50:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v3": { "createdDate": "2019-09-24T20:55:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v1": { "createdDate": "2019-04-05T19:39:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v4": { "createdDate": "2019-10-14T21:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v5": { "createdDate": "2021-05-19T17:10:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v6": { "createdDate": "2021-11-02T18:33:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v7": { "createdDate": "2023-05-19T20:41:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Action1", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "EC2Action2", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Sid": "EC2Action3", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "ElbAction1", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Sid": "EC2Action4", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v8": { "createdDate": "2019-04-05T19:39:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Action1", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "EC2Action2", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Sid": "EC2Action3", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "ElbAction1", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" }, { "Sid": "EC2Action4", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } }, "v9": { "createdDate": "2019-04-05T19:39:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Action1", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "EC2Action2", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSServiceName": "GlobalAccelerator" } } }, { "Sid": "EC2Action3", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" }, { "Sid": "ElbAction1", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" }, { "Sid": "EC2Action4", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] } ] } } }, "createdDate": "2019-04-05T19:39:13.000Z", "lastUpdatedDate": "2024-10-29T18:23:36.000Z" }, "AmazonWorkMailEventsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonWorkMailEventsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-04-16T16:52:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2019-04-16T16:52:43.000Z", "lastUpdatedDate": "2019-04-16T16:52:43.000Z" }, "AWSAppMeshFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppMeshFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2019-04-16T17:50:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-05T18:47:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh", "Condition": { "StringLike": { "iam:AWSServiceName": [ "appmesh.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2021-01-07T19:54:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh", "Condition": { "StringLike": { "iam:AWSServiceName": [ "appmesh.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListInstances" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-03-05T23:36:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh", "Condition": { "StringLike": { "iam:AWSServiceName": [ "appmesh.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-10-03T22:28:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh", "Condition": { "StringLike": { "iam:AWSServiceName": [ "appmesh.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-07-18T21:18:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh", "Condition": { "StringLike": { "iam:AWSServiceName": [ "appmesh.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" } ] } } }, "createdDate": "2019-04-16T17:50:40.000Z", "lastUpdatedDate": "2021-01-07T19:54:08.000Z" }, "AWSAppMeshReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSAppMeshReadOnly", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-04-16T17:51:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:Describe*", "appmesh:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-07-18T21:18:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:Describe*", "appmesh:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" } ] } }, "v3": { "createdDate": "2019-10-03T22:25:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:Describe*", "appmesh:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-03-05T23:54:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:Describe*", "appmesh:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-01-07T19:53:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:Describe*", "appmesh:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*" ], "Resource": "arn:aws:cloudformation:*:*:stack/AWSAppMesh-GettingStarted-*" }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "acm:DescribeCertificate", "acm-pca:DescribeCertificateAuthority", "acm-pca:ListCertificateAuthorities" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListInstances" ], "Resource": "*" } ] } } }, "createdDate": "2019-04-16T17:51:11.000Z", "lastUpdatedDate": "2021-01-07T19:53:16.000Z" }, "AmazonManagedBlockchainConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonManagedBlockchainConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-04-29T21:23:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "managedblockchain:*", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateVpcEndpoint", "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" } ] } } }, "createdDate": "2019-04-29T21:23:25.000Z", "lastUpdatedDate": "2019-04-29T21:23:25.000Z" }, "AmazonManagedBlockchainFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonManagedBlockchainFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-04-29T21:39:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "managedblockchain:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-04-29T21:39:29.000Z", "lastUpdatedDate": "2019-04-29T21:39:29.000Z" }, "AmazonManagedBlockchainReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonManagedBlockchainReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-04-30T18:17:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "managedblockchain:Get*", "managedblockchain:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-04-30T18:17:31.000Z", "lastUpdatedDate": "2019-04-30T18:17:31.000Z" }, "AWSDenyAll": { "arn": "arn:aws:iam::aws:policy/AWSDenyAll", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-05-01T22:36:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "*" ], "Effect": "Deny", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-05-01T22:36:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAll", "Effect": "Deny", "Action": [ "*" ], "Resource": "*" } ] } } }, "createdDate": "2019-05-01T22:36:14.000Z", "lastUpdatedDate": "2023-12-18T16:42:05.000Z" }, "AWSControlTowerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSControlTowerServiceRolePolicy", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2019-05-03T18:19:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole" ] } ] } }, "v2": { "createdDate": "2019-05-23T19:14:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole" ] } ] } }, "v3": { "createdDate": "2019-06-13T16:36:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole" ] } ] } }, "v4": { "createdDate": "2020-05-11T23:04:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": "config.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-08-10T19:17:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": "config.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2020-11-10T21:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": "config.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2021-06-04T23:00:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:PutEventSelectors", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": "config.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2022-10-31T19:12:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:PutEventSelectors", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution", "arn:aws:iam::*:role/AWSControlTowerBlueprintAccess" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "config.amazonaws.com", "cloudtrail.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloudtrail.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2022-06-20T21:45:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:PutEventSelectors", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "config.amazonaws.com", "cloudtrail.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloudtrail.amazonaws.com" } } } ] } }, "v10": { "createdDate": "2023-04-12T19:15:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:PutEventSelectors", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution", "arn:aws:iam::*:role/AWSControlTowerBlueprintAccess" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "config.amazonaws.com", "cloudtrail.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloudtrail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "account:EnableRegion", "account:ListRegions", "account:GetRegionOptStatus" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2019-05-03T18:19:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:type/resource/AWS-IAM-Role" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStack", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:UpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSControlTower*/*", "arn:aws:cloudformation:*:*:stack/StackSet-AWSControlTower*/*", "arn:aws:cloudformation:*:*:stackset/AWSControlTower*:*", "arn:aws:cloudformation:*:*:stackset-target/AWSControlTower*/*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:CreateTrail", "cloudtrail:DeleteTrail", "cloudtrail:GetTrailStatus", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:UpdateTrail", "cloudtrail:PutEventSelectors", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*", "arn:aws:cloudtrail:*:*:trail/aws-controltower*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-controltower*/*" ] }, { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/AWSControlTowerExecution", "arn:aws:iam::*:role/AWSControlTowerBlueprintAccess" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "ec2:DescribeAvailabilityZones", "iam:ListRoles", "logs:CreateLogGroup", "logs:DescribeLogGroups", "organizations:CreateAccount", "organizations:DescribeAccount", "organizations:DescribeCreateAccountStatus", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListRoots", "organizations:MoveAccount", "servicecatalog:AssociatePrincipalWithPortfolio" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetUser", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AWSControlTowerStackSetRole", "arn:aws:iam::*:role/service-role/AWSControlTowerCloudTrailRole", "arn:aws:iam::*:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations" ] }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator", "config:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "config.amazonaws.com", "cloudtrail.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "cloudtrail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "account:EnableRegion", "account:ListRegions", "account:GetRegionOptStatus" ], "Resource": "*" }, { "Sid": "AllowActionsForCloudFormationHooksIntegration", "Effect": "Allow", "Action": [ "cloudformation:SetTypeConfiguration", "cloudformation:DeactivateType", "cloudformation:ActivateType" ], "Resource": "arn:aws:cloudformation:*:*:type/hook/AWS-ControlTower*" } ] } } }, "createdDate": "2019-05-03T18:19:11.000Z", "lastUpdatedDate": "2025-01-13T18:22:06.000Z" }, "AmazonRoute53ResolverFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53ResolverFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-05-30T18:10:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53resolver:*", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-07-17T19:03:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53resolver:*", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-05-30T18:10:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ResolverFullAccess", "Effect": "Allow", "Action": [ "route53resolver:*", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-05-30T18:10:50.000Z", "lastUpdatedDate": "2024-08-05T20:06:08.000Z" }, "AmazonRoute53ResolverReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53ResolverReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-05-30T18:11:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53resolver:Get*", "route53resolver:List*", "ec2:DescribeNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2019-09-27T16:37:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53resolver:Get*", "route53resolver:List*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2019-05-30T18:11:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ResolverReadOnlyAccess", "Effect": "Allow", "Action": [ "route53resolver:Get*", "route53resolver:List*", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-05-30T18:11:31.000Z", "lastUpdatedDate": "2024-08-05T18:54:11.000Z" }, "AWSIoTSiteWiseConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTSiteWiseConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-05-31T21:37:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "iotsitewise:*", "Effect": "Allow", "Resource": "*" }, { "Action": [ "iotanalytics:List*", "iotanalytics:Describe*", "iotanalytics:Create*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iot:DescribeEndpoint", "iot:GetThingShadow" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "greengrass:GetGroup", "greengrass:GetGroupVersion", "greengrass:GetCoreDefinitionVersion", "greengrass:ListGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "secretsmanager:ListSecrets", "secretsmanager:CreateSecret" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "secretsmanager:UpdateSecret" ], "Effect": "Allow", "Resource": "arn:aws:secretsmanager:*:*:secret:greengrass-*" }, { "Action": [ "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/iotsitewise.amazonaws.com/AWSServiceRoleForIoTSiteWise*", "Condition": { "StringEquals": { "iam:AWSServiceName": "iotsitewise.amazonaws.com" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/iotsitewise.amazonaws.com/AWSServiceRoleForIoTSiteWise*", "Condition": { "StringEquals": { "iam:PassedToService": "iotsitewise.amazonaws.com" } } } ] } } }, "createdDate": "2019-05-31T21:37:49.000Z", "lastUpdatedDate": "2019-05-31T21:37:49.000Z" }, "AWSAppMeshServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAppMeshServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-06-03T18:30:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-09-10T22:44:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" }, { "Sid": "ACMCertificateVerification", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-06-03T18:30:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances", "servicediscovery:DiscoverInstancesRevision" ], "Resource": "*" }, { "Sid": "ACMCertificateVerification", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-03T18:30:51.000Z", "lastUpdatedDate": "2023-10-10T16:46:37.000Z" }, "AWSResourceAccessManagerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceAccessManagerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-04T17:28:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ram:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-06-04T17:28:22.000Z", "lastUpdatedDate": "2019-06-04T17:28:22.000Z" }, "MigrationHubServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MigrationHubServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v3": { "createdDate": "2020-08-06T18:08:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": "dms:AddTagsToResource", "Resource": [ "arn:aws:dms:*:*:endpoint:*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2019-06-12T17:22:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2020-02-20T16:59:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } }, { "Effect": "Allow", "Action": "dms:AddTagsToResource", "Resource": [ "arn:aws:dms:*:*:endpoint:*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws:migrationhub:source-id" } } } ] } } }, "createdDate": "2019-06-12T17:22:16.000Z", "lastUpdatedDate": "2020-08-06T18:08:46.000Z" }, "MigrationHubDMSAccessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MigrationHubDMSAccessServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-12T17:50:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgh:CreateProgressUpdateStream", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS" }, { "Effect": "Allow", "Action": [ "mgh:DescribeMigrationTask", "mgh:AssociateDiscoveredResource", "mgh:ListDiscoveredResources", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:DisassociateDiscoveredResource", "mgh:AssociateCreatedArtifact", "mgh:NotifyMigrationTaskState", "mgh:DisassociateCreatedArtifact", "mgh:PutResourceAttributes" ], "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS/migrationTask/*" }, { "Effect": "Allow", "Action": [ "mgh:ListMigrationTasks", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T17:57:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgh:CreateProgressUpdateStream", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS" }, { "Effect": "Allow", "Action": [ "mgh:DescribeMigrationTask", "mgh:AssociateDiscoveredResource", "mgh:ListDiscoveredResources", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:DisassociateDiscoveredResource", "mgh:AssociateCreatedArtifact", "mgh:NotifyMigrationTaskState", "mgh:DisassociateCreatedArtifact", "mgh:PutResourceAttributes" ], "Resource": "arn:aws:mgh:*:*:progressUpdateStream/DMS/migrationTask/*" }, { "Effect": "Allow", "Action": [ "mgh:ListMigrationTasks", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:GetHomeRegion" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-12T17:50:39.000Z", "lastUpdatedDate": "2019-10-07T17:57:44.000Z" }, "MigrationHubSMSAccessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MigrationHubSMSAccessServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-12T18:30:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgh:CreateProgressUpdateStream", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS" }, { "Effect": "Allow", "Action": [ "mgh:DescribeMigrationTask", "mgh:AssociateDiscoveredResource", "mgh:ListDiscoveredResources", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:DisassociateDiscoveredResource", "mgh:AssociateCreatedArtifact", "mgh:NotifyMigrationTaskState", "mgh:DisassociateCreatedArtifact", "mgh:PutResourceAttributes" ], "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS/migrationTask/*" }, { "Effect": "Allow", "Action": [ "mgh:ListMigrationTasks", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-10-07T18:02:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgh:CreateProgressUpdateStream", "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS" }, { "Effect": "Allow", "Action": [ "mgh:DescribeMigrationTask", "mgh:AssociateDiscoveredResource", "mgh:ListDiscoveredResources", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:DisassociateDiscoveredResource", "mgh:AssociateCreatedArtifact", "mgh:NotifyMigrationTaskState", "mgh:DisassociateCreatedArtifact", "mgh:PutResourceAttributes" ], "Resource": "arn:aws:mgh:*:*:progressUpdateStream/SMS/migrationTask/*" }, { "Effect": "Allow", "Action": [ "mgh:ListMigrationTasks", "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", "mgh:GetHomeRegion" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-12T18:30:28.000Z", "lastUpdatedDate": "2019-10-07T18:02:22.000Z" }, "AWSConfigMultiAccountSetupPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSConfigMultiAccountSetupPolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-06-17T18:03:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-13T18:22:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConformancePack", "config:DeleteConformancePack", "config:DescribeConformancePackStatus" ], "Resource": "arn:aws:config:*:*:conformance-pack/aws-service-conformance-pack/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms", "Condition": { "StringLike": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-03-04T16:51:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeAccount" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConformancePack", "config:DeleteConformancePack", "config:DescribeConformancePackStatus" ], "Resource": "arn:aws:config:*:*:conformance-pack/aws-service-conformance-pack/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms", "Condition": { "StringLike": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-05-21T22:59:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeAccount" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConformancePack", "config:DeleteConformancePack", "config:DescribeConformancePackStatus" ], "Resource": "arn:aws:config:*:*:conformance-pack/aws-service-conformance-pack/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms", "Condition": { "StringLike": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2023-02-24T01:39:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeAccount" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutConformancePack", "config:DeleteConformancePack" ], "Resource": "arn:aws:config:*:*:conformance-pack/aws-service-conformance-pack/config-multiaccountsetup.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "config:DescribeConformancePackStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms", "Condition": { "StringLike": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } } }, "createdDate": "2019-06-17T18:03:16.000Z", "lastUpdatedDate": "2023-02-24T01:39:49.000Z" }, "AWSOpsWorksRegisterCLI_OnPremises": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorksRegisterCLI_OnPremises", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-18T15:33:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "opsworks:AssignInstance", "opsworks:CreateLayer", "opsworks:DeregisterInstance", "opsworks:DescribeInstances", "opsworks:DescribeStackProvisioningParameters", "opsworks:DescribeStacks", "opsworks:UnassignInstance" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateGroup", "iam:AddUserToGroup" ], "Resource": [ "arn:aws:iam::*:group/AWS/OpsWorks/OpsWorks-*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateUser", "iam:CreateAccessKey" ], "Resource": [ "arn:aws:iam::*:user/AWS/OpsWorks/OpsWorks-*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachUserPolicy" ], "Resource": [ "arn:aws:iam::*:user/AWS/OpsWorks/OpsWorks-*" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSOpsWorksInstanceRegistration" } } } ] } } }, "createdDate": "2019-06-18T15:33:16.000Z", "lastUpdatedDate": "2019-06-18T15:33:16.000Z" }, "AWSOpsWorksRegisterCLI_EC2": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorksRegisterCLI_EC2", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-18T15:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "opsworks:AssignInstance", "opsworks:CreateLayer", "opsworks:DeregisterInstance", "opsworks:DescribeInstances", "opsworks:DescribeStackProvisioningParameters", "opsworks:DescribeStacks", "opsworks:UnassignInstance" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-06-18T15:56:17.000Z", "lastUpdatedDate": "2019-06-18T15:56:17.000Z" }, "AWSConfigRemediationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSConfigRemediationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-18T21:21:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ssm:GetDocument", "ssm:DescribeDocument", "ssm:StartAutomationExecution" ], "Resource": "*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } }, "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2019-06-18T21:21:35.000Z", "lastUpdatedDate": "2019-06-18T21:21:35.000Z" }, "AWSAppMeshPreviewServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAppMeshPreviewServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-06-19T19:07:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-08-06T16:08:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" }, { "Sid": "ACMCertificateVerification", "Effect": "Allow", "Action": [ "acm:GetCertificate" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-08-21T21:06:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudMapServiceDiscovery", "Effect": "Allow", "Action": [ "servicediscovery:DiscoverInstances" ], "Resource": "*" }, { "Sid": "ACMCertificateVerification", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-19T19:07:00.000Z", "lastUpdatedDate": "2019-08-21T21:06:29.000Z" }, "AWSCertificateManagerPrivateCAPrivilegedUser": { "arn": "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAPrivilegedUser", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-20T17:43:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/*CACertificate*/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/*CACertificate*/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-20T17:43:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/*CACertificate*/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/*CACertificate*/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-20T17:43:13.000Z", "lastUpdatedDate": "2025-01-22T19:52:05.000Z" }, "LakeFormationDataAccessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/LakeFormationDataAccessServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-20T20:46:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "arn:aws:s3:::*" ] } ] } }, "v2": { "createdDate": "2019-06-20T20:46:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LakeFormationDataAccessServiceRolePolicy", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "arn:aws:s3:::*" ] } ] } } }, "createdDate": "2019-06-20T20:46:19.000Z", "lastUpdatedDate": "2024-02-06T18:37:31.000Z" }, "IAMAccessAdvisorReadOnly": { "arn": "arn:aws:iam::aws:policy/IAMAccessAdvisorReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-21T19:33:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:GenerateServiceLastAccessedDetails", "iam:GenerateOrganizationsAccessReport", "iam:GenerateCredentialReport", "iam:GetRole", "iam:GetPolicy", "iam:GetServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetailsWithEntities", "iam:GetOrganizationsAccessReport", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListChildren", "organizations:ListParents", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListPolicies", "organizations:ListTargetsForPolicy" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-21T19:33:45.000Z", "lastUpdatedDate": "2019-06-21T19:33:45.000Z" }, "ServiceQuotasServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-05-22T20:44:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1555536735573", "Action": [ "support:CreateCase", "support:DescribeCases" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-06-24T14:52:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "support:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-05-22T20:44:17.000Z", "lastUpdatedDate": "2019-06-24T14:52:56.000Z" }, "ServiceQuotasReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ServiceQuotasReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-24T15:31:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-12-21T18:11:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "tag:GetTagKeys", "tag:GetTagValues", "servicequotas:GetAssociationForServiceQuotaTemplate", "servicequotas:GetAWSDefaultServiceQuota", "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:GetServiceQuotaIncreaseRequestFromTemplate", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServices", "servicequotas:ListServiceQuotas", "servicequotas:ListServiceQuotaIncreaseRequestsInTemplate", "servicequotas:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2019-06-24T15:31:06.000Z", "lastUpdatedDate": "2020-12-21T18:11:57.000Z" }, "ServiceQuotasFullAccess": { "arn": "arn:aws:iam::aws:policy/ServiceQuotasFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-06-24T15:44:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "servicequotas:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "*", "Condition": { "Null": { "cloudwatch:ResourceTag/ServiceQuotaMonitor": "false" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": [ "servicequotas.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2020-10-08T22:17:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "servicequotas:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "*", "Condition": { "Null": { "cloudwatch:ResourceTag/ServiceQuotaMonitor": "false" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "servicequotas.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-12-21T18:12:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "tag:GetTagKeys", "tag:GetTagValues", "servicequotas:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "*", "Condition": { "Null": { "cloudwatch:ResourceTag/ServiceQuotaMonitor": "false" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "servicequotas.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2021-02-04T21:29:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "cloudformation:DescribeAccountLimits", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "dynamodb:DescribeLimits", "elasticloadbalancing:DescribeAccountLimits", "iam:GetAccountSummary", "kinesis:DescribeLimits", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "rds:DescribeAccountAttributes", "route53:GetAccountLimit", "tag:GetTagKeys", "tag:GetTagValues", "servicequotas:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/ServiceQuotaMonitor": "false" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "servicequotas.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } } ] } } }, "createdDate": "2019-06-24T15:44:35.000Z", "lastUpdatedDate": "2021-02-04T21:29:43.000Z" }, "AWSMarketplaceProcurementSystemAdminFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceProcurementSystemAdminFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-25T13:07:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:PutProcurementSystemConfiguration", "aws-marketplace:DescribeProcurementSystemConfiguration", "organizations:Describe*", "organizations:List*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-06-25T13:07:47.000Z", "lastUpdatedDate": "2019-06-25T13:07:47.000Z" }, "EC2InstanceConnect": { "arn": "arn:aws:iam::aws:policy/EC2InstanceConnect", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-27T18:53:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2InstanceConnect", "Action": [ "ec2:DescribeInstances", "ec2-instance-connect:SendSSHPublicKey" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-06-27T18:53:34.000Z", "lastUpdatedDate": "2019-06-27T18:53:34.000Z" }, "AmazonWorkSpacesServiceAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesServiceAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-06-27T19:19:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "galaxy:DescribeDomains" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-18T23:32:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-06-27T19:19:09.000Z", "lastUpdatedDate": "2020-03-18T23:32:10.000Z" }, "AmazonWorkSpacesSelfServiceAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesSelfServiceAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-06-27T19:22:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "workspaces:RebootWorkspaces", "workspaces:RebuildWorkspaces", "workspaces:ModifyWorkspaceProperties" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-06-27T19:22:52.000Z", "lastUpdatedDate": "2019-06-27T19:22:52.000Z" }, "AWSMarketplaceSellerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceSellerFullAccess", "latestVersionId": "v16", "versionsCount": 16, "versions": { "v1": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-05T23:10:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-10-09T22:23:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-05-28T21:07:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } } ] } }, "v5": { "createdDate": "2021-11-30T19:26:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2022-07-26T15:06:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-11-18T23:54:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v8": { "createdDate": "2022-12-22T23:33:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v9": { "createdDate": "2023-06-01T17:46:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v10": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v11": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewMarketing", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace-management:viewSettings", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } }, "v12": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } }, "v13": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } }, "v14": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:GetSellerDashboard", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } }, "v15": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:GetSellerDashboard", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } }, "v16": { "createdDate": "2019-07-02T20:40:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MarketplaceManagement", "Effect": "Allow", "Action": [ "aws-marketplace-management:uploadFiles", "aws-marketplace-management:viewReports", "aws-marketplace-management:viewSupport", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:GetSellerDashboard", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Sid": "AgreementAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AssetScanning", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Sid": "VendorInsights", "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Sid": "TagManagement", "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "SellerSettings", "Effect": "Allow", "Action": [ "aws-marketplace-management:GetSellerVerificationDetails", "aws-marketplace-management:PutSellerVerificationDetails", "aws-marketplace-management:GetBankAccountVerificationDetails", "aws-marketplace-management:PutBankAccountVerificationDetails", "aws-marketplace-management:GetSecondaryUserVerificationDetails", "aws-marketplace-management:PutSecondaryUserVerificationDetails", "aws-marketplace-management:GetAdditionalSellerNotificationRecipients", "aws-marketplace-management:PutAdditionalSellerNotificationRecipients", "payments:GetPaymentInstrument", "payments:CreatePaymentInstrument", "tax:GetTaxInterview", "tax:PutTaxInterview", "tax:GetTaxInfoReportingDocument", "tax:ListSupplementalTaxRegistrations", "tax:PutSupplementalTaxRegistration", "tax:DeleteSupplementalTaxRegistration", "tax:GetTaxRegistration" ], "Resource": "*" }, { "Sid": "Support", "Effect": "Allow", "Action": [ "support:CreateCase" ], "Resource": "*" }, { "Sid": "ResourcePolicyManagement", "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "resale-authorization.marketplace.amazonaws.com" } } } ] } } }, "createdDate": "2019-07-02T20:40:09.000Z", "lastUpdatedDate": "2025-01-14T19:52:06.000Z" }, "AWSMarketplaceSellerProductsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceSellerProductsFullAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2019-07-02T21:06:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-05T23:11:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-10-09T22:22:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2021-11-26T18:50:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-07-26T15:06:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-11-19T00:15:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v7": { "createdDate": "2023-07-18T22:19:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v8": { "createdDate": "2019-07-02T21:06:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:UpdateTask", "aws-marketplace:CompleteTask", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v9": { "createdDate": "2019-07-02T21:06:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:ModifyImageAttribute", "ec2:ModifySnapshotAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "assets.marketplace.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy", "aws-marketplace:PutResourcePolicy", "aws-marketplace:DeleteResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } } }, "createdDate": "2019-07-02T21:06:25.000Z", "lastUpdatedDate": "2024-12-10T19:06:12.000Z" }, "AWSMarketplaceSellerProductsReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceSellerProductsReadOnly", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-07-02T21:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-05T23:11:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-19T00:08:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v4": { "createdDate": "2019-07-02T21:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListTasks", "aws-marketplace:DescribeTask", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } }, "v5": { "createdDate": "2019-07-02T21:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListAssessments", "aws-marketplace:DescribeAssessment", "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListTagsForResource" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:GetResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/*" } ] } } }, "createdDate": "2019-07-02T21:40:47.000Z", "lastUpdatedDate": "2024-12-10T18:51:14.000Z" }, "AWSAppMeshEnvoyAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppMeshEnvoyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-07-03T21:29:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh:StreamAggregatedResources" ], "Resource": "*" } ] } } }, "createdDate": "2019-07-03T21:29:37.000Z", "lastUpdatedDate": "2019-07-03T21:29:37.000Z" }, "AmazonEventBridgeReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2019-07-11T13:59:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-11-06T03:15:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-03-04T19:08:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays", "events:DescribeConnection", "events:ListConnections", "events:DescribeApiDestination", "events:ListApiDestinations" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-04-08T20:42:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays", "events:DescribeConnection", "events:ListConnections", "events:DescribeApiDestination", "events:ListApiDestinations", "events:DescribeEndpoint", "events:ListEndpoints" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-12-01T17:02:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays", "events:DescribeConnection", "events:ListConnections", "events:DescribeApiDestination", "events:ListApiDestinations", "events:DescribeEndpoint", "events:ListEndpoints", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ExportSchema", "schemas:GetCodeBindingSource", "schemas:GetDiscoveredSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "schemas:SearchSchemas", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListSchedules", "scheduler:ListScheduleGroups", "scheduler:ListTagsForResource", "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-11-10T18:01:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DescribeEventBus", "events:DescribeEventSource", "events:ListEventBuses", "events:ListEventSources", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "events:TestEventPattern", "events:DescribeArchive", "events:ListArchives", "events:DescribeReplay", "events:ListReplays", "events:DescribeConnection", "events:ListConnections", "events:DescribeApiDestination", "events:ListApiDestinations", "events:DescribeEndpoint", "events:ListEndpoints", "schemas:DescribeCodeBinding", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ExportSchema", "schemas:GetCodeBindingSource", "schemas:GetDiscoveredSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:ListTagsForResource", "schemas:SearchSchemas", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListSchedules", "scheduler:ListScheduleGroups", "scheduler:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2019-07-11T13:59:07.000Z", "lastUpdatedDate": "2022-12-01T17:02:48.000Z" }, "AmazonEventBridgeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-07-11T14:08:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "events:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "events.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-03-04T18:56:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "events:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "events.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-11-10T18:01:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgeActions", "Effect": "Allow", "Action": [ "events:*", "schemas:*", "scheduler:*" ], "Resource": "*" }, { "Sid": "IAMCreateServiceLinkedRoleForApiDestinations", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas", "Condition": { "StringEquals": { "iam:AWSServiceName": "schemas.amazonaws.com" } } }, { "Sid": "SecretsManagerAccessForApiDestinations", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Sid": "IAMPassRoleAccessForEventBridge", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "events.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForScheduler", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "scheduler.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-12-01T17:00:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgeActions", "Effect": "Allow", "Action": [ "events:*", "schemas:*", "scheduler:*", "pipes:*" ], "Resource": "*" }, { "Sid": "IAMCreateServiceLinkedRoleForApiDestinations", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas", "Condition": { "StringEquals": { "iam:AWSServiceName": "schemas.amazonaws.com" } } }, { "Sid": "SecretsManagerAccessForApiDestinations", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Sid": "IAMPassRoleAccessForEventBridge", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "events.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForScheduler", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "scheduler.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForPipes", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "pipes.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2019-07-11T14:08:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgeActions", "Effect": "Allow", "Action": [ "events:*", "schemas:*", "scheduler:*", "pipes:*" ], "Resource": "*" }, { "Sid": "IAMCreateServiceLinkedRoleForApiDestinations", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations", "Condition": { "StringEquals": { "iam:AWSServiceName": "apidestinations.events.amazonaws.com" } } }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas", "Condition": { "StringEquals": { "iam:AWSServiceName": "schemas.amazonaws.com" } } }, { "Sid": "SecretsManagerAccessForApiDestinations", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!*" }, { "Sid": "IAMPassRoleAccessForEventBridge", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "events.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForScheduler", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "scheduler.amazonaws.com" } } }, { "Sid": "IAMPassRoleAccessForPipes", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "pipes.amazonaws.com" } } } ] } } }, "createdDate": "2019-07-11T14:08:55.000Z", "lastUpdatedDate": "2025-01-22T01:37:06.000Z" }, "CloudWatch-CrossAccountAccess": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-07-23T09:59:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/CloudWatch-CrossAccountSharing*" ], "Effect": "Allow" } ] } } }, "createdDate": "2019-07-23T09:59:27.000Z", "lastUpdatedDate": "2019-07-23T09:59:27.000Z" }, "CloudWatchAutomaticDashboardsAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchAutomaticDashboardsAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-07-23T10:01:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudfront:GetDistribution", "cloudfront:ListDistributions", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "elasticache:DescribeCacheClusters", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "kinesis:DescribeStream", "kinesis:ListStreams", "lambda:GetFunction", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "route53:GetHealthCheck", "route53:ListHealthChecks", "s3:ListAllMyBuckets", "s3:ListBucket", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:us-east-1::/restapis/*" ] } ] } }, "v2": { "createdDate": "2019-11-20T12:58:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudfront:GetDistribution", "cloudfront:ListDistributions", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "elasticache:DescribeCacheClusters", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "kinesis:DescribeStream", "kinesis:ListStreams", "lambda:GetFunction", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "route53:GetHealthCheck", "route53:ListHealthChecks", "s3:ListAllMyBuckets", "s3:ListBucket", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:us-east-1::/restapis/*" ] } ] } }, "v3": { "createdDate": "2020-12-18T17:48:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudfront:GetDistribution", "cloudfront:ListDistributions", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "elasticache:DescribeCacheClusters", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "kinesis:DescribeStream", "kinesis:ListStreams", "lambda:GetFunction", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "route53:GetHealthCheck", "route53:ListHealthChecks", "s3:ListAllMyBuckets", "s3:ListBucket", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/restapis*" ] } ] } }, "v4": { "createdDate": "2021-04-20T13:05:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudfront:GetDistribution", "cloudfront:ListDistributions", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "elasticache:DescribeCacheClusters", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "kinesis:DescribeStream", "kinesis:ListStreams", "lambda:GetFunction", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "route53:GetHealthCheck", "route53:ListHealthChecks", "s3:ListAllMyBuckets", "s3:ListBucket", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListQueues", "synthetics:DescribeCanariesLastRun", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/restapis*" ] } ] } } }, "createdDate": "2019-07-23T10:01:08.000Z", "lastUpdatedDate": "2021-04-20T13:05:40.000Z" }, "ConfigConformsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ConfigConformsServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2019-07-25T21:38:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:DescribeConfigRules" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" } ] } }, "v2": { "createdDate": "2019-10-02T00:31:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:DescribeConfigRules" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource": "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition": { "StringLike": { "iam:AWSServiceName": "remediation.config.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::awsconfigconforms*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" } ] } }, "v4": { "createdDate": "2019-11-13T18:29:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:DescribeConfigRules" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource": "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition": { "StringLike": { "iam:AWSServiceName": "remediation.config.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::awsconfigconforms*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" } ] } }, "v3": { "createdDate": "2019-10-17T22:16:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:DescribeConfigRules" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource": "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition": { "StringLike": { "iam:AWSServiceName": "remediation.config.amazonaws.com" } } }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject" ], "Resource": "arn:aws:s3:::awsconfigconforms*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" } ] } }, "v5": { "createdDate": "2022-07-26T00:33:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule", "config:DescribeConfigRules" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource": "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition": { "StringLike": { "iam:AWSServiceName": "remediation.config.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::awsconfigconforms*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Config" } } } ] } }, "v6": { "createdDate": "2023-01-12T04:17:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigRules" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource": "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition": { "StringLike": { "iam:AWSServiceName": "remediation.config.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::awsconfigconforms*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Config" } } } ] } } }, "createdDate": "2019-07-25T21:38:05.000Z", "lastUpdatedDate": "2023-01-12T04:17:34.000Z" }, "AWSCloudFormationFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-07-26T21:50:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": "*" } ] } } }, "createdDate": "2019-07-26T21:50:35.000Z", "lastUpdatedDate": "2019-07-26T21:50:35.000Z" }, "ElementalAppliancesSoftwareFullAccess": { "arn": "arn:aws:iam::aws:policy/ElementalAppliancesSoftwareFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-07-31T16:28:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aesop:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-18T19:03:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aesop:*", "elemental-appliances-software:*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-12-02T18:50:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-appliances-software:*" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-02-05T21:01:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-appliances-software:*", "elemental-activations:CompleteAccountRegistration" ], "Resource": "*" } ] } } }, "createdDate": "2019-07-31T16:28:53.000Z", "lastUpdatedDate": "2021-02-05T21:01:25.000Z" }, "AWSAppMeshPreviewEnvoyAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppMeshPreviewEnvoyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-05T23:32:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appmesh-preview:StreamAggregatedResources" ], "Resource": "*" } ] } } }, "createdDate": "2019-08-05T23:32:39.000Z", "lastUpdatedDate": "2019-08-05T23:32:39.000Z" }, "AWSVPCS2SVpnServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSVPCS2SVpnServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-06T14:13:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "0", "Effect": "Allow", "Action": [ "acm:ExportCertificate", "acm:DescribeCertificate", "acm:ListCertificates", "acm-pca:DescribeCertificateAuthority" ], "Resource": "*" } ] } } }, "createdDate": "2019-08-06T14:13:58.000Z", "lastUpdatedDate": "2019-08-06T14:13:58.000Z" }, "AWSServiceRoleForSMS": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForSMS", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2019-08-06T18:39:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v2": { "createdDate": "2019-11-21T00:14:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v4": { "createdDate": "2020-04-20T17:55:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunRemoteScript", "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:s3:::*" ], "Effect": "Allow" }, { "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v3": { "createdDate": "2019-12-23T23:18:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunRemoteScript", "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:s3:::*" ], "Effect": "Allow" }, { "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v5": { "createdDate": "2020-07-20T18:48:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunRemoteScript", "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:s3:::*" ], "Effect": "Allow" }, { "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v6": { "createdDate": "2020-07-25T02:26:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunRemoteScript", "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:s3:::*" ], "Effect": "Allow" }, { "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v9": { "createdDate": "2020-09-29T18:07:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Condition": { "Null": { "cloudformation:ResourceTypes": "false" }, "ForAllValues:StringEquals": { "cloudformation:ResourceTypes": [ "AWS::EC2::Instance" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*" }, { "Effect": "Allow", "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:s3:::sms-app-*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ssm:resourceTag/UseForSMSApplicationValidation": [ "true" ] } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeSnapshotAttribute", "ec2:DeregisterImage", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "cloudformation.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v7": { "createdDate": "2020-08-01T03:40:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow", "Condition": { "ForAllValues:StringLikeIfExists": { "cloudformation:ResourceTypes": [ "AWS::EC2::*" ] } } }, { "Action": [ "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:ValidateTemplate", "cloudformation:DescribeStackResource", "s3:ListAllMyBuckets" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*", "Effect": "Allow" }, { "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunRemoteScript", "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:s3:::*" ], "Effect": "Allow" }, { "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:CopyImage", "ec2:Describe*", "ec2:DeleteSnapshot", "ec2:DeregisterImage", "ec2:RunInstances", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Action": "iam:GetRole", "Resource": "*", "Effect": "Allow" }, { "Action": "iam:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" } ] } }, "v8": { "createdDate": "2020-08-11T20:46:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Condition": { "Null": { "cloudformation:ResourceTypes": "false" }, "ForAllValues:StringEquals": { "cloudformation:ResourceTypes": [ "AWS::EC2::Instance" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*" }, { "Effect": "Allow", "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:s3:::sms-app-*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ssm:resourceTag/UseForSMSApplicationValidation": [ "true" ] } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeSnapshotAttribute", "ec2:DeregisterImage", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "cloudformation.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v10": { "createdDate": "2020-10-15T17:28:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Condition": { "Null": { "cloudformation:ResourceTypes": "false" }, "ForAllValues:StringEquals": { "cloudformation:ResourceTypes": [ "AWS::EC2::Instance", "AWS::ApplicationInsights::Application", "AWS::ResourceGroups::Group" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*" }, { "Effect": "Allow", "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:s3:::sms-app-*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ssm:resourceTag/UseForSMSApplicationValidation": [ "true" ] } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeSnapshotAttribute", "ec2:DeregisterImage", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "cloudformation.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "applicationinsights:Describe*", "applicationinsights:List*", "cloudformation:ListStackResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "applicationinsights:CreateApplication", "applicationinsights:CreateComponent", "applicationinsights:UpdateApplication", "applicationinsights:DeleteApplication", "applicationinsights:UpdateComponentConfiguration", "applicationinsights:DeleteComponent" ], "Resource": "arn:aws:applicationinsights:*:*:application/resource-group/sms-app-*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:GetGroup", "resource-groups:UpdateGroup", "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/sms-app-*", "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } } }, "createdDate": "2019-08-06T18:39:29.000Z", "lastUpdatedDate": "2020-10-15T17:28:13.000Z" }, "AWSIoTDeviceDefenderEnableIoTLoggingMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderEnableIoTLoggingMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:04:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:SetV2LoggingOptions" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "iot.amazonaws.com" ] } } } ] } } }, "createdDate": "2019-08-07T17:04:07.000Z", "lastUpdatedDate": "2019-08-07T17:04:07.000Z" }, "AWSIoTDeviceDefenderPublishFindingsToSNSMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderPublishFindingsToSNSMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:04:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-08-07T17:04:37.000Z", "lastUpdatedDate": "2019-08-07T17:04:37.000Z" }, "AWSIoTDeviceDefenderReplaceDefaultPolicyMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderReplaceDefaultPolicyMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:04:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:CreatePolicyVersion" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-08-07T17:04:57.000Z", "lastUpdatedDate": "2019-08-07T17:04:57.000Z" }, "AWSIoTDeviceDefenderUpdateCACertMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderUpdateCACertMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:05:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:UpdateCACertificate" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-08-07T17:05:49.000Z", "lastUpdatedDate": "2019-08-07T17:05:49.000Z" }, "AWSIoTDeviceDefenderUpdateDeviceCertMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderUpdateDeviceCertMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:06:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:UpdateCertificate" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-08-07T17:06:00.000Z", "lastUpdatedDate": "2019-08-07T17:06:00.000Z" }, "AWSIoTDeviceDefenderAddThingsToThingGroupMitigationAction": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAddThingsToThingGroupMitigationAction", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-07T17:55:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:ListPrincipalThings", "iot:AddThingToThingGroup" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-08-07T17:55:37.000Z", "lastUpdatedDate": "2019-08-07T17:55:37.000Z" }, "AWSLakeFormationDataAdmin": { "arn": "arn:aws:iam::aws:policy/AWSLakeFormationDataAdmin", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-08-08T17:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lakeformation:*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "glue:GetDatabase", "glue:GetDatabases", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:GetConnections", "glue:SearchTables", "glue:GetTable", "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:GetTableVersions", "glue:GetPartitions", "glue:GetTables", "glue:GetWorkflow", "glue:ListWorkflows", "glue:BatchGetWorkflows", "glue:DeleteWorkflow", "glue:GetWorkflowRuns", "glue:StartWorkflowRun", "glue:GetWorkflow", "s3:ListObjects", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "iam:ListUsers", "iam:ListRoles", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "lakeformation:PutDataLakeSettings" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-12-16T22:41:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lakeformation:*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "glue:GetDatabase", "glue:GetDatabases", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:GetConnections", "glue:SearchTables", "glue:GetTable", "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:GetTableVersions", "glue:GetPartitions", "glue:GetTables", "glue:GetWorkflow", "glue:ListWorkflows", "glue:BatchGetWorkflows", "glue:DeleteWorkflow", "glue:GetWorkflowRuns", "glue:StartWorkflowRun", "glue:GetWorkflow", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "iam:ListUsers", "iam:ListRoles", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "lakeformation:PutDataLakeSettings" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-08-08T17:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSLakeFormationDataAdminAllow", "Effect": "Allow", "Action": [ "lakeformation:*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "glue:GetDatabase", "glue:GetDatabases", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:GetConnections", "glue:SearchTables", "glue:GetTable", "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:GetTableVersions", "glue:GetPartitions", "glue:GetTables", "glue:ListWorkflows", "glue:BatchGetWorkflows", "glue:DeleteWorkflow", "glue:GetWorkflowRuns", "glue:StartWorkflowRun", "glue:GetWorkflow", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "iam:ListUsers", "iam:ListRoles", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": "*" }, { "Sid": "AWSLakeFormationDataAdminDeny", "Effect": "Deny", "Action": [ "lakeformation:PutDataLakeSettings" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-08-08T17:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSLakeFormationDataAdminAllow", "Effect": "Allow", "Action": [ "lakeformation:*", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "glue:CreateCatalog", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetDatabase", "glue:GetDatabases", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:GetConnections", "glue:SearchTables", "glue:GetTable", "glue:CreateTable", "glue:UpdateTable", "glue:DeleteTable", "glue:GetTableVersions", "glue:GetPartitions", "glue:GetTables", "glue:ListWorkflows", "glue:BatchGetWorkflows", "glue:DeleteWorkflow", "glue:GetWorkflowRuns", "glue:StartWorkflowRun", "glue:GetWorkflow", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "iam:ListUsers", "iam:ListRoles", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": "*" }, { "Sid": "AWSLakeFormationDataAdminDeny", "Effect": "Deny", "Action": [ "lakeformation:PutDataLakeSettings" ], "Resource": "*" } ] } } }, "createdDate": "2019-08-08T17:33:44.000Z", "lastUpdatedDate": "2024-12-03T15:06:06.000Z" }, "AWSIQContractServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIQContractServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-22T19:28:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:Subscribe" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-08-22T19:28:39.000Z", "lastUpdatedDate": "2019-08-22T19:28:39.000Z" }, "AWSIQPermissionServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIQPermissionServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-08-22T19:36:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/AWSIQPermission-*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AWSIQPermission-*", "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSDenyAll" } } }, { "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AWSIQPermission-*" } ] } } }, "createdDate": "2019-08-22T19:36:29.000Z", "lastUpdatedDate": "2019-08-22T19:36:29.000Z" }, "AmazonQLDBReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonQLDBReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-09-05T18:19:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-19T17:47:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-07-02T02:17:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2019-09-05T18:19:24.000Z", "lastUpdatedDate": "2021-07-02T02:17:25.000Z" }, "AmazonQLDBFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonQLDBFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2020-05-19T17:47:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2019-09-05T18:23:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-05-27T17:15:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-09-02T23:21:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "qldb.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-11-04T17:01:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction", "qldb:PartiQLRedact" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "qldb.amazonaws.com" } } } ] } } }, "createdDate": "2019-09-05T18:23:32.000Z", "lastUpdatedDate": "2022-11-04T17:01:27.000Z" }, "AmazonQLDBConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonQLDBConsoleFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-09-05T18:24:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:ExecuteStatement", "qldb:ShowCatalog", "qldb:InsertSampleData" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dbqms:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-19T17:45:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:GetBlock", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:ExecuteStatement", "qldb:ShowCatalog", "qldb:InsertSampleData" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dbqms:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kinesis:ListStreams", "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-05-27T17:22:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:ExecuteStatement", "qldb:ShowCatalog", "qldb:InsertSampleData", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dbqms:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kinesis:ListStreams", "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2021-09-02T23:21:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:ExecuteStatement", "qldb:ShowCatalog", "qldb:InsertSampleData", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dbqms:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kinesis:ListStreams", "kinesis:DescribeStream" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "qldb.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-11-04T17:01:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "qldb:CreateLedger", "qldb:UpdateLedger", "qldb:UpdateLedgerPermissionsMode", "qldb:DeleteLedger", "qldb:ListLedgers", "qldb:DescribeLedger", "qldb:ExportJournalToS3", "qldb:ListJournalS3Exports", "qldb:ListJournalS3ExportsForLedger", "qldb:DescribeJournalS3Export", "qldb:CancelJournalKinesisStream", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:StreamJournalToKinesis", "qldb:GetBlock", "qldb:GetDigest", "qldb:GetRevision", "qldb:TagResource", "qldb:UntagResource", "qldb:ListTagsForResource", "qldb:SendCommand", "qldb:ExecuteStatement", "qldb:ShowCatalog", "qldb:InsertSampleData", "qldb:PartiQLCreateTable", "qldb:PartiQLCreateIndex", "qldb:PartiQLDropTable", "qldb:PartiQLDropIndex", "qldb:PartiQLUndropTable", "qldb:PartiQLDelete", "qldb:PartiQLInsert", "qldb:PartiQLUpdate", "qldb:PartiQLSelect", "qldb:PartiQLHistoryFunction", "qldb:PartiQLRedact" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dbqms:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:ListStreams", "kinesis:DescribeStream" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "qldb.amazonaws.com" } } } ] } } }, "createdDate": "2019-09-05T18:24:20.000Z", "lastUpdatedDate": "2022-11-04T17:01:10.000Z" }, "AmazonChimeVoiceConnectorServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonChimeVoiceConnectorServiceLinkedRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-09-30T22:16:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetVoiceConnector*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2021-12-21T00:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetVoiceConnector*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeVoiceConnector-*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] } ] } }, "v3": { "createdDate": "2022-03-17T16:18:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetVoiceConnector*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeVoiceConnector-*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2023-04-14T21:49:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetVoiceConnector*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeVoiceConnector-*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "chime:CreateMediaInsightsPipeline", "chime:GetMediaInsightsPipelineConfiguration" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2023-03-23T19:39:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetVoiceConnector*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeVoiceConnector-*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "SNS:Publish" ], "Resource": [ "arn:aws:sns:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:ChimeVoiceConnector-Streaming*" ] }, { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "chime:CreateMediaInsightsPipeline" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-09-30T22:16:42.000Z", "lastUpdatedDate": "2023-04-14T21:49:14.000Z" }, "AmazonChimeServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonChimeServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-09-30T22:25:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/chime.amazonaws.com/AWSServiceRoleForAmazonChime" ], "Condition": { "StringLike": { "iam:AWSServiceName": "chime.amazonaws.com" } } } ] } } }, "createdDate": "2019-09-30T22:25:06.000Z", "lastUpdatedDate": "2019-09-30T22:25:06.000Z" }, "AWSServiceRoleForLogDeliveryPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForLogDeliveryPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-10-04T17:31:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "*", "Condition": { "StringEquals": { "firehose:ResourceTag/LogDeliveryEnabled": "true" } }, "Effect": "Allow" } ] } }, "v2": { "createdDate": "2020-07-27T19:38:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch", "firehose:ListTagsForDeliveryStream" ], "Resource": "*", "Condition": { "StringEquals": { "firehose:ResourceTag/LogDeliveryEnabled": "true" } }, "Effect": "Allow" } ] } }, "v3": { "createdDate": "2021-07-15T20:07:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch", "firehose:ListTagsForDeliveryStream" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/LogDeliveryEnabled": "true" } } } ] } }, "v4": { "createdDate": "2019-10-04T17:31:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LogDeliveryToFirehose", "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch", "firehose:ListTagsForDeliveryStream" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/LogDeliveryEnabled": "true" } } } ] } } }, "createdDate": "2019-10-04T17:31:19.000Z", "lastUpdatedDate": "2025-01-16T21:37:06.000Z" }, "AlexaForBusinessPolyDelegatedAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessPolyDelegatedAccessPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-10-16T19:48:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "a4b:DisassociateDeviceFromRoom", "a4b:DeleteDevice", "a4b:UpdateDevice", "a4b:GetDevice" ], "Effect": "Allow", "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A238TWV36W3S92", "arn:aws:a4b:us-east-1:*:device/*/*:A1FUZ1SC53VJXD" ] }, { "Action": [ "a4b:RegisterAVSDevice" ], "Effect": "Allow", "Resource": [ "*" ], "Condition": { "StringEquals": { "a4b:amazonId": [ "A238TWV36W3S92", "A1FUZ1SC53VJXD" ] } } }, { "Action": [ "a4b:SearchDevices" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "a4b:AssociateDeviceWithRoom" ], "Effect": "Allow", "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A238TWV36W3S92", "arn:aws:a4b:us-east-1:*:device/*/*:A1FUZ1SC53VJXD", "arn:aws:a4b:us-east-1:*:room/*" ] }, { "Action": [ "a4b:GetRoom", "a4b:SearchRooms", "a4b:CreateRoom", "a4b:GetProfile", "a4b:SearchSkillGroups", "a4b:DisassociateSkillGroupFromRoom", "a4b:AssociateSkillGroupWithRoom", "a4b:GetSkillGroup", "a4b:SearchProfiles", "a4b:GetAddressBook", "a4b:UpdateRoom" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-10-16T19:48:45.000Z", "lastUpdatedDate": "2019-10-16T19:48:45.000Z" }, "AmazonSageMakerNotebooksServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonSageMakerNotebooksServiceRolePolicy", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2019-10-18T20:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:RevokeSecurityGroupEgress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } } ] } }, "v2": { "createdDate": "2019-11-14T22:43:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } } ] } }, "v3": { "createdDate": "2019-11-26T18:58:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-04-02T21:13:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-08-28T22:39:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-01-12T20:01:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateAccessPoint", "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*", "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DeleteAccessPoint", "elasticfilesystem:DescribeAccessPoints" ], "Resource": "arn:aws:elasticfilesystem:*:*:access-point/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2023-03-09T18:20:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "elasticfilesystem:CreateAccessPoint", "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*", "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DeleteAccessPoint" ], "Resource": "arn:aws:elasticfilesystem:*:*:access-point/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "elasticfilesystem:TagResource", "Resource": [ "arn:aws:elasticfilesystem:*:*:access-point/*", "arn:aws:elasticfilesystem:*:*:file-system/*" ], "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-10-18T20:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEFSAccessPointCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateAccessPoint", "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*", "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSAccessPointDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:DeleteAccessPoint" ], "Resource": "arn:aws:elasticfilesystem:*:*:access-point/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSMountWithDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSDescribe", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "AllowEFSTagging", "Effect": "Allow", "Action": "elasticfilesystem:TagResource", "Resource": [ "arn:aws:elasticfilesystem:*:*:access-point/*", "arn:aws:elasticfilesystem:*:*:file-system/*" ], "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEC2Tagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AllowEC2Operations", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Sid": "AllowEC2AuthZ", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowIdcOperations", "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Sid": "AllowSagemakerProfileCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" }, { "Sid": "AllowSagemakerSpaceOperationsForCanvasManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DescribeSpace", "sagemaker:DeleteSpace", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*" }, { "Sid": "AllowSagemakerAddTagsForAppManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*", "Condition": { "StringEquals": { "sagemaker:TaggingAction": "CreateSpace" } } } ] } }, "v9": { "createdDate": "2019-10-18T20:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSageMakerDeleteApp", "Effect": "Allow", "Action": [ "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*" }, { "Sid": "AllowEFSAccessPointCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateAccessPoint", "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*", "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSAccessPointDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:DeleteAccessPoint" ], "Resource": "arn:aws:elasticfilesystem:*:*:access-point/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSMountWithDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSDescribe", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "AllowEFSTagging", "Effect": "Allow", "Action": "elasticfilesystem:TagResource", "Resource": [ "arn:aws:elasticfilesystem:*:*:access-point/*", "arn:aws:elasticfilesystem:*:*:file-system/*" ], "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEC2Tagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AllowEC2Operations", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Sid": "AllowEC2AuthZ", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowIdcOperations", "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Sid": "AllowSagemakerProfileCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" }, { "Sid": "AllowSagemakerSpaceOperationsForCanvasManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DescribeSpace", "sagemaker:DeleteSpace", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*" }, { "Sid": "AllowSagemakerAddTagsForAppManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*", "Condition": { "StringEquals": { "sagemaker:TaggingAction": "CreateSpace" } } } ] } }, "v10": { "createdDate": "2019-10-18T20:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFSxDescribe", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDeleteApp", "Effect": "Allow", "Action": [ "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*" }, { "Sid": "AllowEFSAccessPointCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateAccessPoint", "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*", "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSAccessPointDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:DeleteAccessPoint" ], "Resource": "arn:aws:elasticfilesystem:*:*:access-point/*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSCreation", "Effect": "Allow", "Action": "elasticfilesystem:CreateFileSystem", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSMountWithDeletion", "Effect": "Allow", "Action": [ "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEFSDescribe", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "AllowEFSTagging", "Effect": "Allow", "Action": "elasticfilesystem:TagResource", "Resource": [ "arn:aws:elasticfilesystem:*:*:access-point/*", "arn:aws:elasticfilesystem:*:*:file-system/*" ], "Condition": { "StringLike": { "aws:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowEC2Tagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AllowEC2Operations", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:DeleteNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Sid": "AllowEC2AuthZ", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ManagedByAmazonSageMakerResource": "*" } } }, { "Sid": "AllowIdcOperations", "Effect": "Allow", "Action": [ "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "sso:GetManagedApplicationInstance" ], "Resource": "*" }, { "Sid": "AllowSagemakerProfileCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile" ], "Resource": "*" }, { "Sid": "AllowSagemakerSpaceOperationsForCanvasManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DescribeSpace", "sagemaker:DeleteSpace", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*" }, { "Sid": "AllowSagemakerAddTagsForAppManagedSpaces", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace-*", "Condition": { "StringEquals": { "sagemaker:TaggingAction": "CreateSpace" } } } ] } } }, "createdDate": "2019-10-18T20:27:37.000Z", "lastUpdatedDate": "2024-11-14T20:33:45.000Z" }, "AWSApplicationAutoscalingLambdaConcurrencyPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingLambdaConcurrencyPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-10-21T20:04:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:PutProvisionedConcurrencyConfig", "lambda:GetProvisionedConcurrencyConfig", "lambda:DeleteProvisionedConcurrencyConfig", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-10-21T20:04:17.000Z", "lastUpdatedDate": "2019-10-21T20:04:17.000Z" }, "AWSSystemsManagerAccountDiscoveryServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSystemsManagerAccountDiscoveryServicePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-10-24T17:21:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListParents" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-17T20:25:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListParents", "organizations:ListDelegatedServicesForAccount", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-27T18:04:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListParents", "organizations:ListDelegatedServicesForAccount", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } } }, "createdDate": "2019-10-24T17:21:05.000Z", "lastUpdatedDate": "2022-10-17T20:25:02.000Z" }, "AWSServiceCatalogEndUserReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogEndUserReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-10-25T18:49:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:DescribeChangeSet", "cloudformation:ListChangeSets", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "servicecatalog:DescribeProduct", "servicecatalog:DescribeProductView", "servicecatalog:DescribeProvisioningParameters", "servicecatalog:ListLaunchPaths", "servicecatalog:SearchProducts", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:DescribeProvisionedProduct", "servicecatalog:DescribeRecord", "servicecatalog:ListRecordHistory", "servicecatalog:ListStackInstancesForProvisionedProduct", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:DescribeProvisionedProductPlan", "servicecatalog:ListProvisionedProductPlans", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:DescribeServiceActionExecutionParameters" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } } ] } } }, "createdDate": "2019-10-25T18:49:34.000Z", "lastUpdatedDate": "2019-10-25T18:49:34.000Z" }, "AWSServiceCatalogAdminReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-10-25T18:53:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks", "cloudformation:DescribeChangeSet", "cloudformation:ListChangeSets", "cloudformation:ListStackResources", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/SC-*", "arn:aws:cloudformation:*:*:stack/StackSet-SC-*", "arn:aws:cloudformation:*:*:changeSet/SC-*", "arn:aws:cloudformation:*:*:stackset/SC-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "iam:GetGroup", "iam:GetRole", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers", "servicecatalog:Get*", "servicecatalog:List*", "servicecatalog:Describe*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:Search*", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:ListDocuments", "ssm:ListDocumentVersions", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" } ] } } }, "createdDate": "2019-10-25T18:53:38.000Z", "lastUpdatedDate": "2019-10-25T18:53:38.000Z" }, "AWSPrivateMarketplaceRequests": { "arn": "arn:aws:iam::aws:policy/AWSPrivateMarketplaceRequests", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-10-28T21:44:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:CreatePrivateMarketplaceRequests", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": "*" } ] } } }, "createdDate": "2019-10-28T21:44:03.000Z", "lastUpdatedDate": "2019-10-28T21:44:03.000Z" }, "AWSForWordPressPluginPolicy": { "arn": "arn:aws:iam::aws:policy/AWSForWordPressPluginPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-10-30T00:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Permissions1", "Effect": "Allow", "Action": [ "s3:HeadBucket", "polly:SynthesizeSpeech", "polly:DescribeVoices", "translate:TranslateText" ], "Resource": "*" }, { "Sid": "Permissions2", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::audio_for_wordpress*", "arn:aws:s3:::audio-for-wordpress*" ] }, { "Sid": "Permissions3", "Effect": "Allow", "Action": [ "acm:AddTagsToCertificate", "acm:DescribeCertificate", "acm:RequestCertificate", "cloudformation:CreateStack", "cloudfront:ListDistributions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1" } } }, { "Sid": "Permissions4", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:UpdateStack", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:DeleteDistribution", "cloudfront:GetDistribution", "cloudfront:GetInvalidation", "cloudfront:TagResource", "cloudfront:UpdateDistribution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/createdBy": "AWSForWordPressPlugin" } } } ] } }, "v2": { "createdDate": "2020-01-20T23:20:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Permissions1", "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech", "polly:DescribeVoices", "translate:TranslateText" ], "Resource": "*" }, { "Sid": "Permissions2", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::audio_for_wordpress*", "arn:aws:s3:::audio-for-wordpress*" ] }, { "Sid": "Permissions3", "Effect": "Allow", "Action": [ "acm:AddTagsToCertificate", "acm:DescribeCertificate", "acm:RequestCertificate", "cloudformation:CreateStack", "cloudfront:ListDistributions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1" } } }, { "Sid": "Permissions4", "Effect": "Allow", "Action": [ "acm:DeleteCertificate", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:UpdateStack", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:DeleteDistribution", "cloudfront:GetDistribution", "cloudfront:GetInvalidation", "cloudfront:TagResource", "cloudfront:UpdateDistribution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/createdBy": "AWSForWordPressPlugin" } } } ] } } }, "createdDate": "2019-10-30T00:27:46.000Z", "lastUpdatedDate": "2020-01-20T23:20:47.000Z" }, "AWSCodeStarNotificationsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSCodeStarNotificationsServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-11-05T16:10:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule" ], "Resource": "arn:aws:events:*:*:rule/awscodestarnotifications-*", "Effect": "Allow" }, { "Action": [ "codecommit:GetCommentsForPullRequest", "codecommit:GetCommentsForComparedCommit" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codecommit:GetFile" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceTag/ExcludeFileContentFromNotifications": "true" } }, "Effect": "Allow" } ] } }, "v2": { "createdDate": "2019-12-12T23:00:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule" ], "Resource": "arn:aws:events:*:*:rule/awscodestarnotifications-*", "Effect": "Allow" }, { "Action": [ "codecommit:GetCommentsForPullRequest", "codecommit:GetCommentsForComparedCommit", "codepipeline:GetPipeline" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codecommit:GetFile" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceTag/ExcludeFileContentFromNotifications": "true" } }, "Effect": "Allow" } ] } }, "v3": { "createdDate": "2020-02-12T17:52:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule" ], "Resource": "arn:aws:events:*:*:rule/awscodestarnotifications-*", "Effect": "Allow" }, { "Action": [ "codecommit:GetCommentsForPullRequest", "codecommit:GetCommentsForComparedCommit", "codecommit:GetDifferences", "codepipeline:GetPipeline", "codepipeline:ListActionExecutions" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codecommit:GetFile" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceTag/ExcludeFileContentFromNotifications": "true" } }, "Effect": "Allow" } ] } }, "v4": { "createdDate": "2020-03-19T16:01:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule" ], "Resource": "arn:aws:events:*:*:rule/awscodestarnotifications-*", "Effect": "Allow" }, { "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:CodeStarNotifications-*", "Effect": "Allow" }, { "Action": [ "codecommit:GetCommentsForPullRequest", "codecommit:GetCommentsForComparedCommit", "chatbot:DescribeSlackChannelConfigurations", "chatbot:UpdateSlackChannelConfiguration", "codecommit:GetDifferences", "codepipeline:ListActionExecutions" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codecommit:GetFile" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceTag/ExcludeFileContentFromNotifications": "true" } }, "Effect": "Allow" } ] } } }, "createdDate": "2019-11-05T16:10:21.000Z", "lastUpdatedDate": "2020-03-19T16:01:55.000Z" }, "AmazonElasticFileSystemServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2020-07-16T16:48:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:MountCapsule", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "backup:CreateBackupVault", "backup:PutBackupVaultAccessPolicy" ], "Resource": [ "arn:aws:backup:*:*:backup-vault:aws/efs/automatic-backup-vault" ] }, { "Effect": "Allow", "Action": [ "backup:CreateBackupPlan", "backup:CreateBackupSelection" ], "Resource": [ "arn:aws:backup:*:*:backup-plan:aws/efs/*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2019-11-05T16:52:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaceAttribute", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-07-16T19:27:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:MountCapsule", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "backup:CreateBackupVault", "backup:PutBackupVaultAccessPolicy" ], "Resource": [ "arn:aws:backup:*:*:backup-vault:aws/efs/automatic-backup-vault" ] }, { "Effect": "Allow", "Action": [ "backup:CreateBackupPlan", "backup:CreateBackupSelection" ], "Resource": [ "arn:aws:backup:*:*:backup-plan:*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-01-10T19:27:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:MountCapsule", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "backup:CreateBackupVault", "backup:PutBackupVaultAccessPolicy" ], "Resource": [ "arn:aws:backup:*:*:backup-vault:aws/efs/automatic-backup-vault" ] }, { "Effect": "Allow", "Action": [ "backup:CreateBackupPlan", "backup:CreateBackupSelection" ], "Resource": [ "arn:aws:backup:*:*:backup-plan:*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateReplicationConfiguration", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DeleteReplicationConfiguration" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2019-11-05T16:52:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:MountCapsule", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "backup:CreateBackupVault", "backup:PutBackupVaultAccessPolicy" ], "Resource": [ "arn:aws:backup:*:*:backup-vault:aws/efs/automatic-backup-vault" ] }, { "Effect": "Allow", "Action": [ "backup:CreateBackupPlan", "backup:CreateBackupSelection" ], "Resource": [ "arn:aws:backup:*:*:backup-plan:*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateReplicationConfiguration", "elasticfilesystem:DescribeReplicationConfigurations", "elasticfilesystem:DeleteReplicationConfiguration", "elasticfilesystem:ReplicationRead", "elasticfilesystem:ReplicationWrite" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-05T16:52:41.000Z", "lastUpdatedDate": "2024-11-07T19:19:50.000Z" }, "AWSSavingsPlansReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-06T22:45:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "savingsplans:Describe*", "savingsplans:List*" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-06T22:45:10.000Z", "lastUpdatedDate": "2019-11-06T22:45:10.000Z" }, "AWSSavingsPlansFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSavingsPlansFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-06T22:45:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "savingsplans:*", "Resource": "*" } ] } } }, "createdDate": "2019-11-06T22:45:18.000Z", "lastUpdatedDate": "2019-11-06T22:45:18.000Z" }, "WAFV2LoggingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-11-07T00:40:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-waf-logs-*" ] } ] } }, "v2": { "createdDate": "2020-07-23T17:04:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-waf-logs-*" ] }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-07T00:40:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "FirehoseAPIStatement", "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": [ "arn:aws:firehose:*:*:deliverystream/aws-waf-logs-*" ] }, { "Sid": "DescribeOrganizationAPIStatement", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" } ] } } }, "createdDate": "2019-11-07T00:40:56.000Z", "lastUpdatedDate": "2024-06-03T17:29:04.000Z" }, "AWSServiceRoleForAmazonEKSNodegroup": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2019-11-07T01:34:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToIAM", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "iam.amazonaws.com" } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v2": { "createdDate": "2020-01-16T21:53:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToIAM", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "iam.amazonaws.com" } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v3": { "createdDate": "2020-02-21T20:40:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToIAM", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "iam.amazonaws.com" } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v4": { "createdDate": "2020-03-06T22:14:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToIAM", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "iam.amazonaws.com" } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v5": { "createdDate": "2020-08-31T19:07:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v6": { "createdDate": "2022-01-14T00:33:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v7": { "createdDate": "2019-11-07T01:34:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v8": { "createdDate": "2019-11-07T01:34:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeCapacityReservations" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v9": { "createdDate": "2019-11-07T01:34:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeCapacityReservations" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToManageEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } }, "v10": { "createdDate": "2019-11-07T01:34:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SharedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks": "*" } } }, { "Sid": "EKSCreatedSecurityGroupRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "LaunchTemplateRelatedPermissions", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "AutoscalingRelatedPermissions", "Effect": "Allow", "Action": [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses" ], "Resource": "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid": "AllowAutoscalingToCreateSLR", "Effect": "Allow", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } }, "Action": "iam:CreateServiceLinkedRole", "Resource": "*" }, { "Sid": "AllowASGCreationByEKS", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid": "AllowPassRoleToAutoscaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "autoscaling.amazonaws.com" } } }, { "Sid": "AllowPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "PermissionsToManageResourcesForNodegroups", "Effect": "Allow", "Action": [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeCapacityReservations" ], "Resource": "*" }, { "Sid": "PermissionsToCreateAndManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid": "PermissionsToDeleteEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } }, { "Sid": "PermissionsForManagedNodegroupsAutoRepair", "Effect": "Allow", "Action": [ "ec2:RebootInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/eks:nodegroup-name": "*" } } }, { "Sid": "PermissionsToCreateEKSAndKubernetesTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:*:ec2:*:*:security-group/*", "arn:*:ec2:*:*:launch-template/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } }, { "Sid": "AllowTaggingEC2ResourcesOnlyDuringInstanceCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ec2:*:*:volume/*", "arn:*:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] } } }, "createdDate": "2019-11-07T01:34:26.000Z", "lastUpdatedDate": "2024-11-21T00:07:12.000Z" }, "AmazonEC2RolePolicyForLaunchWizard": { "arn": "arn:aws:iam::aws:policy/AmazonEC2RolePolicyForLaunchWizard", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2019-11-13T08:05:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:ModifyVolume", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" } ] } }, "v2": { "createdDate": "2019-11-24T21:48:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:ModifyVolume", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:ModifyInstanceAttribute", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeRegions" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-06-03T23:17:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:ModifyVolume", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeImages", "ec2:DescribeRegions", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:ModifyInstanceAttribute", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:ReplaceRoute" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardApplicationType" } } } ] } }, "v3": { "createdDate": "2020-03-31T22:01:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:ModifyVolume", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeImages", "ec2:DescribeRegions", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:ModifyInstanceAttribute", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:ReplaceRoute" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardApplicationType" } } } ] } }, "v4": { "createdDate": "2020-06-03T18:30:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:ModifyVolume", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:CreateVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:ModifyInstanceAttribute" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeImages", "ec2:DescribeRegions", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeRouteTables", "ec2:ReplaceRoute" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardApplicationType" } } } ] } }, "v6": { "createdDate": "2020-07-01T19:04:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] } ] } }, "v7": { "createdDate": "2020-10-09T22:28:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSSAP-InstallBackint" ] } ] } }, "v8": { "createdDate": "2021-05-24T23:05:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSSAP-InstallBackint" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } } ] } }, "v9": { "createdDate": "2022-01-27T23:01:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSSAP-InstallBackint" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } } ] } }, "v10": { "createdDate": "2022-05-16T21:16:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSSAP-InstallBackint" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "fsx:DescribeStorageVirtualMachines" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } } ] } }, "v11": { "createdDate": "2019-11-13T08:05:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardResourceGroupID": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:ReplaceRoute" ], "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringLike": { "ec2:ResourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeRouteTables", "ec2:ModifyInstanceAttribute", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricData", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LaunchWizardResourceGroupID", "LaunchWizardApplicationType" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectTagging", "s3:GetBucketLocation", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*", "arn:aws:s3:::launchwizard*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "logs:Create*", "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "LaunchWizardResourceGroupID" } } }, { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem", "sqs:ReceiveMessage", "sqs:SendMessage", "dynamodb:Scan", "s3:ListBucket", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:DeleteTable", "dynamodb:CreateTable", "s3:GetObject", "dynamodb:DescribeTable", "s3:GetBucketLocation", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:dynamodb:*:*:table/LaunchWizard*", "arn:aws:sqs:*:*:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/LaunchWizardApplicationType": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSSAP-InstallBackint", "arn:aws:ssm:*:*:document/AWSSAP-InstallBackintForAWSBackup" ] }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "fsx:DescribeStorageVirtualMachines" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } } ] } } }, "createdDate": "2019-11-13T08:05:53.000Z", "lastUpdatedDate": "2024-09-25T22:40:50.000Z" }, "AWSDataExchangeReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeReadOnly", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-11-13T19:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-05-10T21:15:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-11-13T19:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeReadOnlyActions", "Effect": "Allow", "Action": [ "dataexchange:GetAsset", "dataexchange:GetDataSet", "dataexchange:GetEventAction", "dataexchange:GetJob", "dataexchange:GetRevision", "dataexchange:ListDataSetRevisions", "dataexchange:ListDataSets", "dataexchange:ListEventActions", "dataexchange:ListJobs", "dataexchange:ListRevisionAssets", "dataexchange:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AWSMarketplaceReadOnlyActions", "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms", "aws-marketplace:ListPrivateListings", "aws-marketplace:ListTagsForResource" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-11-13T19:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeReadOnlyActions", "Effect": "Allow", "Action": [ "dataexchange:GetAsset", "dataexchange:GetDataSet", "dataexchange:GetEventAction", "dataexchange:GetJob", "dataexchange:GetRevision", "dataexchange:GetDataGrant", "dataexchange:GetReceivedDataGrant", "dataexchange:ListDataGrants", "dataexchange:ListReceivedDataGrants", "dataexchange:ListDataSetRevisions", "dataexchange:ListDataSets", "dataexchange:ListEventActions", "dataexchange:ListJobs", "dataexchange:ListRevisionAssets", "dataexchange:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AWSMarketplaceReadOnlyActions", "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms", "aws-marketplace:ListPrivateListings", "aws-marketplace:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-13T19:27:37.000Z", "lastUpdatedDate": "2024-10-24T14:40:40.000Z" }, "AWSDataExchangeSubscriberFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeSubscriberFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v2": { "createdDate": "2020-04-27T14:28:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-01-14T17:06:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2019-11-13T19:27:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-02-08T23:34:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "EXPORT_REVISIONS_TO_S3" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-11-29T23:00:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "EXPORT_REVISIONS_TO_S3" ] } } }, { "Effect": "Allow", "Action": [ "dataexchange:CreateEventAction", "dataexchange:UpdateEventAction", "dataexchange:DeleteEventAction", "dataexchange:SendApiAsset" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-09-30T21:31:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "EXPORT_REVISIONS_TO_S3" ] } } }, { "Effect": "Allow", "Action": [ "dataexchange:CreateEventAction", "dataexchange:UpdateEventAction", "dataexchange:DeleteEventAction" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-11-13T19:27:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeReadOnlyActions", "Effect": "Allow", "Action": [ "dataexchange:Get*", "dataexchange:List*" ], "Resource": "*" }, { "Sid": "DataExchangeExportActions", "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "EXPORT_REVISIONS_TO_S3" ] } } }, { "Sid": "DataExchangeEventActionActions", "Effect": "Allow", "Action": [ "dataexchange:CreateEventAction", "dataexchange:UpdateEventAction", "dataexchange:DeleteEventAction", "dataexchange:SendApiAsset" ], "Resource": "*" }, { "Sid": "S3GetActionConditionalResourceAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3ReadActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSMarketplaceSubscriberActions", "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest", "aws-marketplace:ListPrivateListings" ], "Resource": "*" }, { "Sid": "KMSActions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-13T19:27:52.000Z", "lastUpdatedDate": "2024-05-21T17:36:35.000Z" }, "AWSDataExchangeProviderFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeProviderFullAccess", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2019-11-13T19:27:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-04-27T14:30:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-11-25T16:25:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-08T15:27:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-01-14T21:20:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-05-25T19:26:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-05-10T21:11:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-11-01T15:13:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-11-29T23:01:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "dataexchange:SendApiAsset", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSET_FROM_API_GATEWAY_API", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2021-12-02T16:12:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "dataexchange:SendApiAsset", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSET_FROM_API_GATEWAY_API", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2022-03-15T16:16:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "dataexchange:SendApiAsset", "dataexchange:RevokeRevision", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSET_FROM_API_GATEWAY_API", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2019-11-13T19:27:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeActions", "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:CreateRevision", "dataexchange:CreateAsset", "dataexchange:Get*", "dataexchange:Update*", "dataexchange:List*", "dataexchange:Delete*", "dataexchange:TagResource", "dataexchange:UntagResource", "dataexchange:PublishDataSet", "dataexchange:SendApiAsset", "dataexchange:RevokeRevision", "dataexchange:SendDataSetNotification", "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Sid": "DataExchangeJobsActions", "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSET_FROM_API_GATEWAY_API", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES" ] } } }, { "Sid": "S3GetActionConditionalResourceAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3GetActionConditionalTagAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3WriteActions", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3ReadActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSMarketplaceActions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:StartChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Sid": "KMSActions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Sid": "RedshiftConditionalActions", "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Sid": "RedshiftActions", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "APIGatewayActions", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-13T19:27:55.000Z", "lastUpdatedDate": "2024-08-15T17:32:54.000Z" }, "AWSDataExchangeFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v2": { "createdDate": "2020-04-27T14:22:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-01-19T19:42:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2019-11-13T19:27:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" } } }, { "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*aws-data-exchange*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-12-02T16:14:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-01T18:55:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-05-10T21:07:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2019-11-13T19:27:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeActions", "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Sid": "S3GetActionConditionalResourceAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3GetActionConditionalTagAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3WriteActions", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3ReadActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSMarketplaceProviderActions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms", "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AWSMarketplaceSubscriberActions", "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest", "aws-marketplace:ListPrivateListings", "aws-marketplace:GetPrivateListing", "aws-marketplace:DescribeAgreement" ], "Resource": "*" }, { "Sid": "KMSActions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Sid": "RedshiftConditionalActions", "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Sid": "RedshiftActions", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "APIGatewayActions", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2019-11-13T19:27:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeActions", "Effect": "Allow", "Action": [ "dataexchange:*" ], "Resource": "*" }, { "Sid": "S3GetActionConditionalResourceAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3GetActionConditionalTagAndADX", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/AWSDataExchange": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3WriteActions", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::*aws-data-exchange*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "dataexchange.amazonaws.com" ] } } }, { "Sid": "S3ReadActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSMarketplaceProviderActions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:StartChangeSet", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:UpdateAgreementApprovalRequest", "aws-marketplace:SearchAgreements", "aws-marketplace:GetAgreementTerms", "aws-marketplace:TagResource", "aws-marketplace:UntagResource", "aws-marketplace:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AWSMarketplaceSubscriberActions", "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions", "aws-marketplace:GetAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreementRequest", "aws-marketplace:ListPrivateListings", "aws-marketplace:DescribeAgreement" ], "Resource": "*" }, { "Sid": "KMSActions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys" ], "Resource": "*" }, { "Sid": "RedshiftConditionalActions", "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "redshift:ConsumerIdentifier": "ADX" } } }, { "Sid": "RedshiftActions", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "APIGatewayActions", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-13T19:27:59.000Z", "lastUpdatedDate": "2024-06-24T19:54:18.000Z" }, "AWSIoTSiteWiseMonitorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIoTSiteWiseMonitorServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-11-14T00:59:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:CreateProject", "iotsitewise:DescribeProject", "iotsitewise:UpdateProject", "iotsitewise:DeleteProject", "iotsitewise:ListProjects", "iotsitewise:BatchAssociateProjectAssets", "iotsitewise:BatchDisassociateProjectAssets", "iotsitewise:ListProjectAssets", "iotsitewise:CreateDashboard", "iotsitewise:DescribeDashboard", "iotsitewise:UpdateDashboard", "iotsitewise:DeleteDashboard", "iotsitewise:ListDashboards", "iotsitewise:CreateAccessPolicy", "iotsitewise:DescribeAccessPolicy", "iotsitewise:UpdateAccessPolicy", "iotsitewise:DeleteAccessPolicy", "iotsitewise:ListAccessPolicies", "iotsitewise:DescribeAsset", "iotsitewise:ListAssets", "iotsitewise:ListAssociatedAssets", "iotsitewise:DescribeAssetProperty", "iotsitewise:GetAssetPropertyValue", "iotsitewise:GetAssetPropertyValueHistory", "iotsitewise:GetAssetPropertyAggregates", "sso-directory:DescribeUser", "sso-directory:DescribeUsers" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2019-12-13T22:19:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:CreateProject", "iotsitewise:DescribeProject", "iotsitewise:UpdateProject", "iotsitewise:DeleteProject", "iotsitewise:ListProjects", "iotsitewise:BatchAssociateProjectAssets", "iotsitewise:BatchDisassociateProjectAssets", "iotsitewise:ListProjectAssets", "iotsitewise:CreateDashboard", "iotsitewise:DescribeDashboard", "iotsitewise:UpdateDashboard", "iotsitewise:DeleteDashboard", "iotsitewise:ListDashboards", "iotsitewise:CreateAccessPolicy", "iotsitewise:DescribeAccessPolicy", "iotsitewise:UpdateAccessPolicy", "iotsitewise:DeleteAccessPolicy", "iotsitewise:ListAccessPolicies", "iotsitewise:DescribeAsset", "iotsitewise:ListAssets", "iotsitewise:ListAssociatedAssets", "iotsitewise:DescribeAssetProperty", "iotsitewise:GetAssetPropertyValue", "iotsitewise:GetAssetPropertyValueHistory", "iotsitewise:GetAssetPropertyAggregates", "sso-directory:DescribeUsers" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-14T00:59:10.000Z", "lastUpdatedDate": "2019-12-13T22:19:25.000Z" }, "AWSApplicationAutoscalingComprehendEndpointPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingComprehendEndpointPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-14T18:39:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "comprehend:UpdateEndpoint", "comprehend:DescribeEndpoint", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2019-11-14T18:39:07.000Z", "lastUpdatedDate": "2019-11-14T18:39:07.000Z" }, "DynamoDBCloudWatchContributorInsightsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/DynamoDBCloudWatchContributorInsightsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-15T21:13:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DeleteInsightRules", "cloudwatch:PutInsightRule" ], "Effect": "Allow", "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*" }, { "Action": [ "cloudwatch:DescribeInsightRules" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-11-15T21:13:58.000Z", "lastUpdatedDate": "2019-11-15T21:13:58.000Z" }, "AWSChatbotServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSChatbotServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-18T16:39:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Unsubscribe", "sns:Subscribe", "sns:ListSubscriptions" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/chatbot/*" } ] } } }, "createdDate": "2019-11-18T16:39:50.000Z", "lastUpdatedDate": "2019-11-18T16:39:50.000Z" }, "AWSBackupFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupFullAccess", "latestVersionId": "v19", "versionsCount": 19, "versions": { "v2": { "createdDate": "2020-01-13T18:40:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" } } } ] } }, "v1": { "createdDate": "2019-11-18T22:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" } } } ] } }, "v4": { "createdDate": "2020-06-06T00:06:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:describeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" } } } ] } }, "v3": { "createdDate": "2020-05-29T23:46:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" } } } ] } }, "v5": { "createdDate": "2020-09-14T22:35:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:describeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v6": { "createdDate": "2020-11-09T16:49:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:describeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2021-07-05T23:28:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2021-03-10T18:32:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v9": { "createdDate": "2021-11-23T22:00:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2022-05-13T17:52:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2022-06-01T17:36:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" } ] } }, "v12": { "createdDate": "2022-08-24T22:03:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v13": { "createdDate": "2022-11-10T22:47:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v15": { "createdDate": "2023-08-08T18:20:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:DeleteBackup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2022-12-15T20:15:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:DeleteBackup" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:CreateGrant" ], "Effect": "Allow", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v16": { "createdDate": "2019-11-18T22:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:DeleteBackup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v17": { "createdDate": "2019-11-18T22:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsBackupAllAccessPermissions", "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Sid": "AwsBackupStorageAllAccessPermissions", "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Sid": "RdsPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RdsDeletePermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DynamoDbPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "DynamoDbDeleteBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:DeleteBackup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "EfsFileSystemPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "Ec2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "Ec2DeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "ResourceGroupTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "IamRolePermissions", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "AwsOrganizationsPermissions", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Sid": "SystemManagerCommandPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SystemManagerSendCommandPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:DescribeBackups", "fsx:DescribeVolumes", "fsx:DescribeStorageVirtualMachines" ], "Resource": "*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DirectoryServicePermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "IamCreateServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "BackupGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Sid": "BackupGatewayHypervisorPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "BackupGatewayVirtualMachinePermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "BackupGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Sid": "CloudWatchPermissions", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "TimestreamDatabasePermissions", "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "RedshiftResourcesPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Sid": "CloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "SystemsManagerForSapPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ResourceAccessManagerPermissions", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v18": { "createdDate": "2019-11-18T22:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsBackupAllAccessPermissions", "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Sid": "AwsBackupStorageAllAccessPermissions", "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Sid": "RdsPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RdsDeletePermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DynamoDbPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "DynamoDbDeleteBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:DeleteBackup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "EfsFileSystemPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "Ec2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "Ec2DeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "ResourceGroupTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayGatewayStarPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "*" }, { "Sid": "IamRolePermissions", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "AwsOrganizationsPermissions", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Sid": "SystemManagerCommandPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SystemManagerSendCommandPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:DescribeBackups", "fsx:DescribeVolumes", "fsx:DescribeStorageVirtualMachines" ], "Resource": "*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DirectoryServicePermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "IamCreateServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "BackupGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Sid": "BackupGatewayHypervisorPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "BackupGatewayVirtualMachinePermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "BackupGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Sid": "CloudWatchPermissions", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "TimestreamDatabasePermissions", "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "RedshiftResourcesPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Sid": "CloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "SystemsManagerForSapPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ResourceAccessManagerPermissions", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v19": { "createdDate": "2019-11-18T22:21:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsBackupAllAccessPermissions", "Effect": "Allow", "Action": "backup:*", "Resource": "*" }, { "Sid": "AwsBackupStorageAllAccessPermissions", "Effect": "Allow", "Action": "backup-storage:*", "Resource": "*" }, { "Sid": "RdsPermissions", "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "RdsDeletePermissions", "Effect": "Allow", "Action": [ "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DynamoDbPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "DynamoDbDeleteBackupPermissions", "Effect": "Allow", "Action": [ "dynamodb:DeleteBackup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "EfsFileSystemPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "Ec2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "Ec2DeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "ResourceGroupTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Sid": "StorageGatewayVolumePermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "StorageGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayGatewayStarPermissions", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "*" }, { "Sid": "IamRolePermissions", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "AwsOrganizationsPermissions", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:backup:backup-vault" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "backup.*.amazonaws.com" } } }, { "Sid": "SystemManagerCommandPermissions", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SystemManagerSendCommandPermissions", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems", "fsx:DescribeBackups", "fsx:DescribeVolumes", "fsx:DescribeStorageVirtualMachines" ], "Resource": "*" }, { "Sid": "FsxDeletePermissions", "Effect": "Allow", "Action": "fsx:DeleteBackup", "Resource": "arn:aws:fsx:*:*:backup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "DirectoryServicePermissions", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "IamCreateServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "backup.amazonaws.com", "restore-testing.backup.amazonaws.com" ] } } }, { "Sid": "BackupGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:AssociateGatewayToServer", "backup-gateway:CreateGateway", "backup-gateway:DeleteGateway", "backup-gateway:DeleteHypervisor", "backup-gateway:DisassociateGatewayFromServer", "backup-gateway:ImportHypervisorConfiguration", "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup-gateway:PutMaintenanceStartTime", "backup-gateway:TagResource", "backup-gateway:TestHypervisorConfiguration", "backup-gateway:UntagResource", "backup-gateway:UpdateGatewayInformation", "backup-gateway:UpdateHypervisor" ], "Resource": "*" }, { "Sid": "BackupGatewayHypervisorPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings", "backup-gateway:PutHypervisorPropertyMappings", "backup-gateway:StartVirtualMachinesMetadataSync" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "BackupGatewayVirtualMachinePermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "BackupGatewayGatewayPermissions", "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway", "backup-gateway:PutBandwidthRateLimitSchedule" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Sid": "CloudWatchPermissions", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "TimestreamDatabasePermissions", "Effect": "Allow", "Action": [ "timestream:ListTables", "timestream:ListDatabases" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "RedshiftResourcesPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Sid": "RedshiftServerlessListPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListSnapshots", "redshift-serverless:ListWorkgroups" ], "Resource": [ "*" ] }, { "Sid": "RedshiftServerlessGetPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetSnapshot", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "RedshiftServerlessDeletetPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:DeleteSnapshot" ], "Resource": [ "arn:aws:redshift-serverless:*:*:snapshot/*" ], "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "backup.amazonaws.com" ] } } }, { "Sid": "CloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "SystemsManagerForSapPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "*" }, { "Sid": "ResourceAccessManagerPermissions", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-18T22:21:52.000Z", "lastUpdatedDate": "2025-03-27T21:52:06.000Z" }, "AWSBackupOperatorAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupOperatorAccess", "latestVersionId": "v17", "versionsCount": 17, "versions": { "v1": { "createdDate": "2019-11-18T22:23:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-05-29T21:52:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2020-01-13T16:15:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-06-24T16:24:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" } ] } }, "v5": { "createdDate": "2020-09-14T22:35:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v6": { "createdDate": "2020-11-09T16:43:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2021-03-10T18:31:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:GetRecoveryPointRestoreMetadata", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBSnapshots", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] } }, "v8": { "createdDate": "2021-11-23T22:00:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2022-05-13T17:57:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2022-06-01T17:35:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" } ] } }, "v11": { "createdDate": "2022-08-24T22:03:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v12": { "createdDate": "2022-11-10T22:52:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": "backup-gateway:GetGateway", "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v14": { "createdDate": "2023-08-08T18:19:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2022-12-15T20:13:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow" }, { "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Action": [ "iam:ListRoles", "iam:GetRole" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } }, "v15": { "createdDate": "2019-11-18T22:23:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListVolumes", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v16": { "createdDate": "2019-11-18T22:23:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsBackupAllAccess", "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Sid": "RDSDescribeAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "DynamoDBAccess", "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "EFSAccess", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EC2Access", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "TagReadAccess", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Sid": "StorageGatewaySCSIAccess", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayReadAccess", "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "StorageGatewayDiskReadAccess", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayVolumeReadAccess", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "*" }, { "Sid": "IAMRoleAccess", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "PassRoleAccess", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Sid": "SSMReadAccess", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMComandAccess", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FSXDescribeAccess", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FSxFileAccess", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FSxVolumeAccess", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Sid": "FSxMachineAccess", "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Sid": "DirectoryServiceAccess", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "BackupGatewayListAccess", "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "BackupGatewayHypervisorAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "BackupGatewayMachineAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "BackupGatewayAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "TimestreamListAccess", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamDescribeAccess", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "RedshiftAccess", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Sid": "RedshiftOptionsAccess", "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Sid": "CloudFormationAccess", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "SAPAccess", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SAPDatabaseAccess", "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Sid": "RAMAccess", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } }, "v17": { "createdDate": "2019-11-18T22:23:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsBackupAllAccess", "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:CreateBackupSelection", "backup:DeleteBackupSelection", "backup:StartBackupJob", "backup:StartRestoreJob", "backup:StartCopyJob" ], "Resource": "*" }, { "Sid": "RDSDescribeAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:describeDBEngineVersions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describeDBSubnetGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups" ], "Resource": "*" }, { "Sid": "DynamoDBAccess", "Effect": "Allow", "Action": [ "dynamodb:ListBackups", "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "EFSAccess", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFilesystems" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*" }, { "Sid": "EC2Access", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:describeAvailabilityZones", "ec2:DescribeVpcs", "ec2:DescribeAccountAttributes", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribePlacementGroups", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "TagReadAccess", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "tag:GetResources" ], "Resource": "*" }, { "Sid": "StorageGatewaySCSIAccess", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "StorageGatewayReadAccess", "Effect": "Allow", "Action": [ "storagegateway:ListGateways" ], "Resource": "arn:aws:storagegateway:*:*:*" }, { "Sid": "StorageGatewayDiskReadAccess", "Effect": "Allow", "Action": [ "storagegateway:DescribeGatewayInformation", "storagegateway:ListLocalDisks" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*" }, { "Sid": "StorageGatewayVolumeReadAccess", "Effect": "Allow", "Action": [ "storagegateway:ListVolumes" ], "Resource": "*" }, { "Sid": "IAMRoleAccess", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "PassRoleAccess", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*AwsBackup*", "arn:aws:iam::*:role/*AWSBackup*" ], "Condition": { "StringLike": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": "organizations:DescribeOrganization", "Resource": "*" }, { "Sid": "SSMReadAccess", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Sid": "SSMComandAccess", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "FSXDescribeAccess", "Effect": "Allow", "Action": "fsx:DescribeBackups", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "FSxFileAccess", "Effect": "Allow", "Action": "fsx:DescribeFileSystems", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Sid": "FSxVolumeAccess", "Effect": "Allow", "Action": "fsx:DescribeVolumes", "Resource": "arn:aws:fsx:*:*:volume/*/*" }, { "Sid": "FSxMachineAccess", "Effect": "Allow", "Action": "fsx:DescribeStorageVirtualMachines", "Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*" }, { "Sid": "DirectoryServiceAccess", "Effect": "Allow", "Action": "ds:DescribeDirectories", "Resource": "*" }, { "Sid": "BackupGatewayListAccess", "Effect": "Allow", "Action": [ "backup-gateway:ListGateways", "backup-gateway:ListHypervisors", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "BackupGatewayHypervisorAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetHypervisor", "backup-gateway:GetHypervisorPropertyMappings" ], "Resource": "arn:aws:backup-gateway:*:*:hypervisor/*" }, { "Sid": "BackupGatewayMachineAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetVirtualMachine" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "BackupGatewayAccess", "Effect": "Allow", "Action": [ "backup-gateway:GetBandwidthRateLimitSchedule", "backup-gateway:GetGateway" ], "Resource": "arn:aws:backup-gateway:*:*:gateway/*" }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "TimestreamListAccess", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamDescribeAccess", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "RedshiftAccess", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeSnapshotSchedules" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:subnetgroup:*", "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:snapshotschedule:*" ] }, { "Sid": "RedshiftOptionsAccess", "Effect": "Allow", "Action": [ "redshift:DescribeNodeConfigurationOptions", "redshift:DescribeOrderableClusterOptions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterTracks" ], "Resource": "*" }, { "Sid": "RedshiftServerlessListPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListSnapshots", "redshift-serverless:ListWorkgroups" ], "Resource": [ "*" ] }, { "Sid": "RedshiftServerlessGetPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetSnapshot", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "CloudFormationAccess", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "SAPAccess", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Sid": "SAPDatabaseAccess", "Effect": "Allow", "Action": [ "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" }, { "Sid": "RAMAccess", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-18T22:23:17.000Z", "lastUpdatedDate": "2025-03-27T21:52:05.000Z" }, "AWSTrustedAdvisorReportingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorReportingServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-11-19T17:41:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-02-28T23:23:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListChildren", "organizations:ListParents", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-09-11T21:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListChildren", "organizations:ListParents", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-11-19T17:41:13.000Z", "lastUpdatedDate": "2023-02-28T23:23:45.000Z" }, "AWSMarketplaceMeteringRegisterUsage": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-21T01:17:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:RegisterUsage" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-11-21T01:17:54.000Z", "lastUpdatedDate": "2019-11-21T01:17:54.000Z" }, "AWSElasticBeanstalkManagedUpdatesServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticBeanstalkManagedUpdatesServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2019-11-21T22:35:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/awseb-e-*" }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/awseb-e-*" } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*" ] } ] } }, "v2": { "createdDate": "2020-05-01T21:54:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/awseb-e-*" }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/awseb-e-*" } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*" ] } ] } }, "v3": { "createdDate": "2020-05-18T22:51:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] } ] } }, "v4": { "createdDate": "2020-09-11T18:28:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:DescribeLogGroups", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] } ] } }, "v6": { "createdDate": "2022-08-23T18:07:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*", "logs:DescribeLogGroups", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-Environment-*" }, { "Sid": "EC2LaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*" }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } } ] } }, "v7": { "createdDate": "2023-01-27T20:23:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*", "logs:DescribeLogGroups", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-Environment-*" }, { "Sid": "EC2LaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*" }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } } ] } }, "v5": { "createdDate": "2020-12-11T18:21:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*", "logs:DescribeLogGroups", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-Environment-*" } ] } }, "v8": { "createdDate": "2023-03-24T00:18:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*", "logs:DescribeLogGroups", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-Environment-*" }, { "Sid": "EC2LaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*" }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "RegisterTaskDefinition" ] } } } ] } }, "v9": { "createdDate": "2019-11-21T22:35:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLikeIfExists": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SingleInstanceAPIs", "Effect": "Allow", "Action": [ "ec2:releaseAddress", "ec2:allocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition", "ecs:List*", "ecs:Describe*" ], "Resource": "*" }, { "Sid": "ElasticBeanstalkAPIs", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "ReadOnlyAPIs", "Effect": "Allow", "Action": [ "cloudformation:Describe*", "cloudformation:List*", "ec2:Describe*", "autoscaling:Describe*", "elasticloadbalancing:Describe*", "logs:DescribeLogGroups", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CancelUpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-e-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*" ] }, { "Sid": "SNS", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-Environment-*" }, { "Sid": "EC2LaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*" }, { "Sid": "AllowLaunchTemplateRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "RegisterTaskDefinition" ] } } } ] } } }, "createdDate": "2019-11-21T22:35:06.000Z", "lastUpdatedDate": "2024-04-29T23:11:34.000Z" }, "AmazonEKSFargatePodExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-22T04:34:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-22T04:34:29.000Z", "lastUpdatedDate": "2019-11-22T04:34:29.000Z" }, "AmazonEKSForFargateServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSForFargateServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-22T04:36:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeRouteTables" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-22T04:36:25.000Z", "lastUpdatedDate": "2019-11-22T04:36:25.000Z" }, "CloudWatchSyntheticsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchSyntheticsFullAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2019-11-25T17:39:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketEncryption", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersionByArn", "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] } ] } }, "v2": { "createdDate": "2020-04-03T17:53:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketEncryption", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersionByArn", "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2020-04-22T18:37:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketEncryption", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersionByArn", "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] } ] } }, "v4": { "createdDate": "2020-09-18T16:39:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketEncryption", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersionByArn", "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] } ] } }, "v5": { "createdDate": "2021-01-27T20:12:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketEncryption", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersionByArn", "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] } ] } }, "v7": { "createdDate": "2021-07-20T15:56:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] } ] } }, "v6": { "createdDate": "2021-03-25T18:40:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] } ] } }, "v8": { "createdDate": "2021-09-29T23:07:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com" ] } } } ] } }, "v9": { "createdDate": "2022-05-06T18:14:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion", "lambda:DeleteLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com" ] } } } ] } }, "v10": { "createdDate": "2019-11-25T17:39:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration", "lambda:DeleteFunction", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion", "lambda:DeleteLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*", "arn:aws:lambda:*:*:layer:Synthetics_Selenium:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2019-11-25T17:39:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "s3:ListAllMyBuckets", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::cw-syn-*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::aws-synthetics-library-*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "logs:GetLogRecord", "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:FilterLogEvents", "logs:GetLogGroupFields" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/cwsyn-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration", "lambda:GetFunction", "lambda:DeleteFunction", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetLayerVersion", "lambda:PublishLayerVersion", "lambda:DeleteLayerVersion" ], "Resource": [ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*", "arn:aws:lambda:*:*:layer:Synthetics_Selenium:*", "arn:aws:lambda:*:*:layer:AWS-CW-Synthetics*:*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Synthetics-*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com" ] } } } ] } } }, "createdDate": "2019-11-25T17:39:46.000Z", "lastUpdatedDate": "2024-11-21T22:21:05.000Z" }, "CloudWatchSyntheticsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchSyntheticsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-11-25T17:45:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:Describe*", "synthetics:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-06T19:26:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:Describe*", "synthetics:Get*", "synthetics:List*" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-25T17:45:40.000Z", "lastUpdatedDate": "2020-03-06T19:26:01.000Z" }, "AmazonEventBridgeSchemasServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEventBridgeSchemasServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-27T01:10:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:EnableRule", "events:DisableRule", "events:DeleteRule", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": [ "arn:aws:events:*:*:rule/*Schemas-*" ] } ] } } }, "createdDate": "2019-11-27T01:10:40.000Z", "lastUpdatedDate": "2019-11-27T01:10:40.000Z" }, "AmazonEventBridgeSchemasReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeSchemasReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-11-28T23:05:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonEventBridgeSchemasReadOnlyAccess", "Effect": "Allow", "Action": [ "schemas:ListDiscoverers", "schemas:DescribeDiscoverer", "schemas:ListRegistries", "schemas:DescribeRegistry", "schemas:SearchSchemas", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:DescribeSchema", "schemas:GetDiscoveredSchema", "schemas:DescribeCodeBinding", "schemas:GetCodeBindingSource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-05-01T00:50:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonEventBridgeSchemasReadOnlyAccess", "Effect": "Allow", "Action": [ "schemas:ListDiscoverers", "schemas:DescribeDiscoverer", "schemas:ListRegistries", "schemas:DescribeRegistry", "schemas:SearchSchemas", "schemas:ListSchemas", "schemas:ListSchemaVersions", "schemas:DescribeSchema", "schemas:GetDiscoveredSchema", "schemas:DescribeCodeBinding", "schemas:GetCodeBindingSource", "schemas:ListTagsForResource", "schemas:GetResourcePolicy" ], "Resource": "*" } ] } } }, "createdDate": "2019-11-28T23:05:57.000Z", "lastUpdatedDate": "2020-05-01T00:50:53.000Z" }, "AmazonEventBridgeSchemasFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeSchemasFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-11-28T23:12:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonEventBridgeSchemasFullAccess", "Effect": "Allow", "Action": [ "schemas:*" ], "Resource": "*" }, { "Sid": "AmazonEventBridgeManageRule", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:EnableRule", "events:DisableRule", "events:DeleteRule", "events:RemoveTargets", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/*Schemas*" }, { "Sid": "IAMCreateServiceLinkedRoleForAmazonEventBridgeSchemas", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/schemas.amazonaws.com/AWSServiceRoleForSchemas" } ] } } }, "createdDate": "2019-11-28T23:12:53.000Z", "lastUpdatedDate": "2019-11-28T23:12:53.000Z" }, "AWSServiceRoleForImageBuilder": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForImageBuilder", "latestVersionId": "v20", "versionsCount": 20, "versions": { "v1": { "createdDate": "2019-11-29T22:02:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" } ] } }, "v2": { "createdDate": "2019-12-02T02:04:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" } ] } }, "v3": { "createdDate": "2019-12-02T06:18:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" } ] } }, "v4": { "createdDate": "2020-02-28T19:03:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" } ] } }, "v5": { "createdDate": "2020-04-01T19:42:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v6": { "createdDate": "2020-04-16T19:45:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v7": { "createdDate": "2020-06-01T17:40:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v8": { "createdDate": "2020-07-15T21:23:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:SuspendProcesses" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:DetachInstances", "autoscaling:DeleteAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "autoscaling:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v9": { "createdDate": "2020-07-30T21:37:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } } ] } }, "v11": { "createdDate": "2020-09-28T18:13:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } }, "v12": { "createdDate": "2020-12-04T23:27:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } } ] } }, "v13": { "createdDate": "2021-08-11T18:07:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } } ] } }, "v14": { "createdDate": "2021-12-06T20:55:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } } ] } }, "v15": { "createdDate": "2022-02-16T18:01:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*::launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } } ] } }, "v10": { "createdDate": "2020-08-31T20:49:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" } ] } }, "v16": { "createdDate": "2022-02-17T00:01:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } } ] } }, "v17": { "createdDate": "2022-06-16T00:09:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:license-manager:*:*:license-configuration:*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } } ] } }, "v18": { "createdDate": "2023-03-13T20:33:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:license-manager:*:*:license-configuration:*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "inspector2:ListCoverage", "inspector2:ListFindings" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:TagResource" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:BatchDeleteImage" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "ecr:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/ImageBuilder-*" ] } ] } }, "v19": { "createdDate": "2019-11-29T22:02:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:license-manager:*:*:license-configuration:*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots", "ec2:DescribeHosts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "inspector2:ListCoverage", "inspector2:ListFindings" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:TagResource" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:BatchDeleteImage" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "ecr:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/ImageBuilder-*" ] } ] } }, "v20": { "createdDate": "2019-11-29T22:02:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RegisterImage", "Resource": [ "arn:aws:ec2:*::image/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "ec2:RegisterImage", "Resource": [ "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:license-manager:*:*:license-configuration:*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "vmie.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:DeregisterImage", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:ModifyImageAttribute", "ec2:DescribeImportImageTasks", "ec2:DescribeExportImageTasks", "ec2:DescribeSnapshots", "ec2:DescribeHosts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateImage" ], "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:export-image-task/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": [ "EC2 Image Builder", "EC2 Fast Launch" ] } } }, { "Effect": "Allow", "Action": [ "license-manager:UpdateLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:AddTagsToResource", "ssm:DescribeInstanceInformation", "ssm:GetAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListInventoryEntries", "ssm:SendAutomationSignal", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeAssociationExecutions", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", "arn:aws:ssm:*:*:document/AWS-RunShellScript", "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ssm:resourceTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/ImageBuilder*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:association/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:ebs:id" ] }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DescribeLaunchTemplates", "ec2:ModifyLaunchTemplate", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:ExportImage" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*" }, { "Effect": "Allow", "Action": [ "ec2:CancelExportTask" ], "Resource": "arn:aws:ec2:*:*:export-image-task/*", "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ssm.amazonaws.com", "ec2fastlaunch.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "inspector2:ListCoverage", "inspector2:ListFindings" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:TagResource" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ecr:BatchDeleteImage" ], "Resource": "arn:aws:ecr:*:*:repository/image-builder-*", "Condition": { "StringEquals": { "ecr:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/ImageBuilder-*" ] } ] } } }, "createdDate": "2019-11-29T22:02:13.000Z", "lastUpdatedDate": "2024-12-26T23:52:06.000Z" }, "EC2InstanceProfileForImageBuilder": { "arn": "arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilder", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2019-12-01T19:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" } ] } }, "v2": { "createdDate": "2020-06-15T17:44:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } }, "v3": { "createdDate": "2020-08-27T16:40:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn", "aws:CalledVia": [ "imagebuilder.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } }, "v4": { "createdDate": "2019-12-01T19:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetMarketplaceResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn", "aws:CalledVia": [ "imagebuilder.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } }, "v5": { "createdDate": "2019-12-01T19:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot", "aws:RequestTag/CreatedBy": [ "EC2 Image Builder" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/*.ISO", "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetMarketplaceResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn", "aws:CalledVia": [ "imagebuilder.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } } }, "createdDate": "2019-12-01T19:08:23.000Z", "lastUpdatedDate": "2024-12-26T23:52:07.000Z" }, "IAMAccessAnalyzerFullAccess": { "arn": "arn:aws:iam::aws:policy/IAMAccessAnalyzerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-02T17:12:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "access-analyzer.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-02T17:12:40.000Z", "lastUpdatedDate": "2019-12-02T17:12:40.000Z" }, "IAMAccessAnalyzerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/IAMAccessAnalyzerReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-12-02T17:12:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:Get*", "access-analyzer:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-03-16T20:37:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:Get*", "access-analyzer:List*", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2019-12-02T17:12:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMAccessAnalyzerReadOnlyAccess", "Effect": "Allow", "Action": [ "access-analyzer:CheckAccessNotGranted", "access-analyzer:CheckNoNewAccess", "access-analyzer:Get*", "access-analyzer:List*", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-12-02T17:12:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMAccessAnalyzerReadOnlyAccess", "Effect": "Allow", "Action": [ "access-analyzer:CheckAccessNotGranted", "access-analyzer:CheckNoNewAccess", "access-analyzer:CheckNoPublicAccess", "access-analyzer:Get*", "access-analyzer:List*", "access-analyzer:ValidatePolicy" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-02T17:12:53.000Z", "lastUpdatedDate": "2024-07-18T17:49:04.000Z" }, "AccessAnalyzerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AccessAnalyzerServiceRolePolicy", "latestVersionId": "v16", "versionsCount": 16, "versions": { "v1": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeByoipCidrs", "ec2:DescribeAddresses", "lambda:ListFunctions", "lambda:GetPolicy", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:GetLayerVersionPolicy", "sqs:GetQueueAttributes", "sqs:ListQueues", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListRoots", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-03-02T15:55:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListAccessPoints", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeByoipCidrs", "ec2:DescribeAddresses", "lambda:ListFunctions", "lambda:GetPolicy", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:GetLayerVersionPolicy", "sqs:GetQueueAttributes", "sqs:ListQueues", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListRoots", "organizations:ListParents", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-04-30T20:28:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-05-19T19:10:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-11-24T20:58:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-09-02T16:49:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2022-10-25T16:50:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-04-06T20:18:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListTables", "dynamodb:ListStreams", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:GetSnapshotBlockPublicAccessState", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:GetSnapshotBlockPublicAccessState", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListUserPolicies", "iam:GetUserPolicy", "iam:ListAttachedUserPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListGroupsForUser", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v14": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:GetSnapshotBlockPublicAccessState", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:ListRoleTags", "iam:ListUserTags", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListUserPolicies", "iam:GetUserPolicy", "iam:ListAttachedUserPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListGroupsForUser", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v15": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:GetSnapshotBlockPublicAccessState", "ecr:DescribeRepositories", "ecr:GetAccountSetting", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:ListRoleTags", "iam:ListUserTags", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListUserPolicies", "iam:GetUserPolicy", "iam:ListAttachedUserPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListGroupsForUser", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } }, "v16": { "createdDate": "2019-12-02T17:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessAnalyzerServiceRolePolicy", "Effect": "Allow", "Action": [ "dynamodb:GetResourcePolicy", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:GetSnapshotBlockPublicAccessState", "ecr:DescribeRepositories", "ecr:GetAccountSetting", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "iam:GetRole", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUsers", "iam:ListRoleTags", "iam:ListUserTags", "iam:GetUser", "iam:GetGroup", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:GetAccessKeyLastUsed", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListUserPolicies", "iam:GetUserPolicy", "iam:ListAttachedUserPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListGroupsForUser", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListVersionsByFunction", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListRoots", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3express:GetAccessPoint", "s3express:GetAccessPointPolicy", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "s3express:ListAccessPointsForDirectoryBuckets", "sns:GetTopicAttributes", "sns:ListTopics", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-02T17:13:10.000Z", "lastUpdatedDate": "2025-04-01T15:52:07.000Z" }, "AmazonCodeGuruReviewerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonCodeGuruReviewerServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-12-03T05:31:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessCodeGuruReviewerEnabledRepositories", "Effect": "Allow", "Action": [ "codecommit:GetRepository", "codecommit:DescribePullRequestEvents", "codecommit:GetCommentsForPullRequest", "codecommit:GetDifferences", "codecommit:GetPullRequest", "codecommit:ListPullRequests", "codecommit:PostCommentForPullRequest", "codecommit:GitPull", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/codeguru-reviewer": "enabled" } } }, { "Sid": "CloudWatchEventsResourceCleanup", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-06-22T05:41:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessCodeGuruReviewerEnabledRepositories", "Effect": "Allow", "Action": [ "codecommit:GetRepository", "codecommit:GetBranch", "codecommit:DescribePullRequestEvents", "codecommit:GetCommentsForPullRequest", "codecommit:GetDifferences", "codecommit:GetPullRequest", "codecommit:ListPullRequests", "codecommit:PostCommentForPullRequest", "codecommit:GitPull", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/codeguru-reviewer": "enabled" } } }, { "Sid": "AccessCodeGuruReviewerEnabledConnections", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "codestar-connections:ProviderAction": [ "ListBranches", "GetBranch", "ListRepositories", "ListOwners", "ListPullRequests", "GetPullRequest", "ListPullRequestComments", "ListPullRequestCommits", "ListCommitFiles", "ListBranchCommits", "CreatePullRequestDiffComment", "GitPull" ] }, "Null": { "aws:ResourceTag/codeguru-reviewer": "false" } } }, { "Sid": "CloudWatchEventsResourceCleanup", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-11-27T15:09:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessCodeGuruReviewerEnabledRepositories", "Effect": "Allow", "Action": [ "codecommit:GetRepository", "codecommit:GetBranch", "codecommit:DescribePullRequestEvents", "codecommit:GetCommentsForPullRequest", "codecommit:GetDifferences", "codecommit:GetPullRequest", "codecommit:ListPullRequests", "codecommit:PostCommentForPullRequest", "codecommit:GitPull", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/codeguru-reviewer": "enabled" } } }, { "Sid": "AccessCodeGuruReviewerEnabledConnections", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "codestar-connections:ProviderAction": [ "ListBranches", "GetBranch", "ListRepositories", "ListOwners", "ListPullRequests", "GetPullRequest", "ListPullRequestComments", "ListPullRequestCommits", "ListCommitFiles", "ListBranchCommits", "CreatePullRequestDiffComment", "GitPull" ] }, "Null": { "aws:ResourceTag/codeguru-reviewer": "false" } } }, { "Sid": "CloudWatchEventsResourceCleanup", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "AllowGuruS3GetObject", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::codeguru-reviewer-*", "arn:aws:s3:::codeguru-reviewer-*/*" ] } ] } }, "v2": { "createdDate": "2020-04-09T07:33:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessCodeGuruReviewerEnabledRepositories", "Effect": "Allow", "Action": [ "codecommit:GetRepository", "codecommit:DescribePullRequestEvents", "codecommit:GetCommentsForPullRequest", "codecommit:GetDifferences", "codecommit:GetPullRequest", "codecommit:ListPullRequests", "codecommit:PostCommentForPullRequest", "codecommit:GitPull", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/codeguru-reviewer": "enabled" } } }, { "Sid": "AccessCodeGuruReviewerEnabledConnections", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "codestar-connections:ProviderAction": [ "ListBranches", "GetBranch", "ListRepositories", "ListOwners", "ListPullRequests", "GetPullRequest", "ListPullRequestComments", "ListPullRequestCommits", "ListCommitFiles", "ListBranchCommits", "CreatePullRequestDiffComment", "GitPull" ] }, "Null": { "aws:ResourceTag/codeguru-reviewer": "false" } } }, { "Sid": "CloudWatchEventsResourceCleanup", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } } }, "createdDate": "2019-12-03T05:31:12.000Z", "lastUpdatedDate": "2020-11-27T15:09:46.000Z" }, "AmazonCodeGuruReviewerFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-12-03T08:33:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:*" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "AmazonCodeGuruReviewerSLRDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer" }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitTagManagement", "Effect": "Allow", "Action": [ "codecommit:TagResource", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "codeguru-reviewer" } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2020-05-07T00:43:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:*" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "AmazonCodeGuruReviewerSLRDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer" }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitTagManagement", "Effect": "Allow", "Action": [ "codecommit:TagResource", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "codeguru-reviewer" } } }, { "Sid": "CodeConnectTagManagement", "Effect": "Allow", "Action": [ "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListTagsForResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "codeguru-reviewer" } } }, { "Sid": "CodeConnectManagedRules", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codestar-connections:ListConnections", "codestar-connections:PassConnection" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "codestar-connections:ProviderAction": [ "ListRepositories", "ListOwners" ] } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2020-08-29T04:16:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruReviewerFullAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:*", "codeguru:*" ], "Resource": "*" }, { "Sid": "AmazonCodeGuruReviewerSLRCreation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", "Condition": { "StringLike": { "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" } } }, { "Sid": "AmazonCodeGuruReviewerSLRDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer" }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitTagManagement", "Effect": "Allow", "Action": [ "codecommit:TagResource", "codecommit:UntagResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "codeguru-reviewer" } } }, { "Sid": "CodeConnectTagManagement", "Effect": "Allow", "Action": [ "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar-connections:ListTagsForResource" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "codeguru-reviewer" } } }, { "Sid": "CodeConnectManagedRules", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codestar-connections:ListConnections", "codestar-connections:PassConnection" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "codestar-connections:ProviderAction": [ "ListRepositories", "ListOwners" ] } } }, { "Sid": "CloudWatchEventsManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "codeguru-reviewer.amazonaws.com" } } } ] } } }, "createdDate": "2019-12-03T08:33:47.000Z", "lastUpdatedDate": "2020-08-29T04:16:08.000Z" }, "ComputeOptimizerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ComputeOptimizerServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-12-03T08:45:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ComputeOptimizerFullAccess", "Effect": "Allow", "Action": [ "compute-optimizer:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-29T16:04:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ComputeOptimizerFullAccess", "Effect": "Allow", "Action": [ "compute-optimizer:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "AutoScalingAccess", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeAutoScalingGroups" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-06-13T19:05:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ComputeOptimizerFullAccess", "Effect": "Allow", "Action": [ "compute-optimizer:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "AutoScalingAccess", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeAutoScalingGroups" ], "Resource": "*" }, { "Sid": "Ec2Access", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2019-12-03T08:45:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ComputeOptimizerFullAccess", "Effect": "Allow", "Action": [ "compute-optimizer:*" ], "Resource": "*" }, { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms" ], "Resource": "*" }, { "Sid": "AutoScalingAccess", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions" ], "Resource": "*" }, { "Sid": "Ec2Access", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T08:45:19.000Z", "lastUpdatedDate": "2025-01-03T21:37:06.000Z" }, "AmazonCodeGuruReviewerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruReviewerReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-12-03T08:48:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru-reviewer:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-08-29T04:15:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", "Effect": "Allow", "Action": [ "codeguru:Get*", "codeguru-reviewer:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T08:48:24.000Z", "lastUpdatedDate": "2020-08-29T04:15:32.000Z" }, "AmazonCodeGuruProfilerFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruProfilerFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2020-04-06T21:16:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru-profiler:*", "iam:ListRoles", "iam:ListUsers", "codeguru:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2019-12-03T10:13:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": "codeguru-profiler:*", "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-06-28T00:04:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru-profiler:*", "iam:ListRoles", "iam:ListUsers", "codeguru:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/*AWSServiceRoleForCodeGuruProfiler*", "Condition": { "StringEquals": { "iam:AWSServiceName": "codeguru-profiler.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2020-07-15T03:23:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru-profiler:*", "iam:ListRoles", "iam:ListUsers", "sns:ListTopics", "codeguru:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/*AWSServiceRoleForCodeGuruProfiler*", "Condition": { "StringEquals": { "iam:AWSServiceName": "codeguru-profiler.amazonaws.com" } } } ] } } }, "createdDate": "2019-12-03T10:13:27.000Z", "lastUpdatedDate": "2020-07-15T03:23:08.000Z" }, "AmazonCodeGuruProfilerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruProfilerReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2019-12-03T10:30:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru-profiler:Get*", "codeguru-profiler:Describe*", "codeguru-profiler:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-06-27T23:52:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru:Get*", "codeguru-profiler:BatchGet*", "codeguru-profiler:Describe*", "codeguru-profiler:Get*", "codeguru-profiler:List*", "iam:ListRoles", "iam:ListUsers" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-04-06T20:34:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeguru-profiler:Get*", "codeguru-profiler:Describe*", "codeguru-profiler:List*", "iam:ListRoles", "iam:ListUsers", "codeguru:Get*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-12-03T10:30:15.000Z", "lastUpdatedDate": "2020-06-27T23:52:52.000Z" }, "AmazonMCSFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMCSFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-12-03T13:45:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-04-17T19:19:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:PutScheduledAction", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScheduledActions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } } ] } } }, "createdDate": "2019-12-03T13:45:25.000Z", "lastUpdatedDate": "2020-04-17T19:19:29.000Z" }, "AmazonMCSReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMCSReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-12-03T13:46:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-04-17T19:21:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T13:46:21.000Z", "lastUpdatedDate": "2020-04-17T19:21:34.000Z" }, "AWSNetworkManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkManagerServiceRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2019-12-03T14:03:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2019-12-10T20:41:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-10T12:06:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2021-06-07T16:18:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-05-24T14:42:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeRegions", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-23T21:38:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeRegions" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-07-12T12:03:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeRegions", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayPolicyTables", "ec2:GetTransitGatewayPolicyTableAssociations", "ec2:GetTransitGatewayPolicyTableEntries" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2022-07-27T19:41:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeLocations", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeCustomerGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeRegions", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayPolicyTables", "ec2:GetTransitGatewayPolicyTableAssociations", "ec2:GetTransitGatewayPolicyTableEntries" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T14:03:35.000Z", "lastUpdatedDate": "2022-07-27T19:41:29.000Z" }, "AmazonKendraReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKendraReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2019-12-03T16:13:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "kendra:Describe*", "kendra:List*", "kendra:Query" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2021-05-27T17:01:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kendra:Describe*", "kendra:List*", "kendra:Query", "kendra:GetQuerySuggestions" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T16:13:45.000Z", "lastUpdatedDate": "2021-05-27T17:01:20.000Z" }, "AmazonKendraFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKendraFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T16:15:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "kendra.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonKendra-*" }, { "Effect": "Allow", "Action": "kendra:*", "Resource": "*" } ] } } }, "createdDate": "2019-12-03T16:15:37.000Z", "lastUpdatedDate": "2019-12-03T16:15:37.000Z" }, "AmazonSageMakerMechanicalTurkAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerMechanicalTurkAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T16:19:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*FlowDefinition", "sagemaker:*FlowDefinitions" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T16:19:36.000Z", "lastUpdatedDate": "2019-12-03T16:19:36.000Z" }, "AmazonAugmentedAIHumanLoopFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAugmentedAIHumanLoopFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T16:20:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*HumanLoop", "sagemaker:*HumanLoops" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T16:20:47.000Z", "lastUpdatedDate": "2019-12-03T16:20:47.000Z" }, "AmazonAugmentedAIFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAugmentedAIFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T16:21:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*HumanLoop", "sagemaker:*HumanLoops", "sagemaker:*FlowDefinition", "sagemaker:*FlowDefinitions", "sagemaker:*HumanTaskUi", "sagemaker:*HumanTaskUis" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } } ] } } }, "createdDate": "2019-12-03T16:21:56.000Z", "lastUpdatedDate": "2019-12-03T16:21:56.000Z" }, "AWSNetworkManagerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSNetworkManagerReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T17:35:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "networkmanager:Describe*", "networkmanager:Get*", "networkmanager:List*" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-03T17:35:05.000Z", "lastUpdatedDate": "2019-12-03T17:35:05.000Z" }, "AWSNetworkManagerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSNetworkManagerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T17:37:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "networkmanager:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "networkmanager.amazonaws.com" ] } } } ] } } }, "createdDate": "2019-12-03T17:37:58.000Z", "lastUpdatedDate": "2019-12-03T17:37:58.000Z" }, "AmazonFraudDetectorFullAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonFraudDetectorFullAccessPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-03T22:46:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "frauddetector:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListEndpoints", "sagemaker:DescribeEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "frauddetector.amazonaws.com" } } } ] } } }, "createdDate": "2019-12-03T22:46:26.000Z", "lastUpdatedDate": "2019-12-03T22:46:26.000Z" }, "AWSResourceAccessManagerResourceShareParticipantAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceAccessManagerResourceShareParticipantAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-09T20:41:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ram:AcceptResourceShareInvitation", "ram:GetResourcePolicies", "ram:GetResourceShareInvitations", "ram:GetResourceShares", "ram:ListPendingInvitationResources", "ram:ListPrincipals", "ram:ListResources", "ram:RejectResourceShareInvitation" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-12-09T20:41:37.000Z", "lastUpdatedDate": "2019-12-09T20:41:37.000Z" }, "AWSResourceAccessManagerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceAccessManagerReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-09T20:58:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ram:Get*", "ram:List*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2019-12-09T20:58:37.000Z", "lastUpdatedDate": "2019-12-09T20:58:37.000Z" }, "CloudFormationStackSetsOrgMemberServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-09T23:52:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:GetRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/stacksets-exec-*" ] }, { "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/stacksets-exec-*" ], "Condition": { "StringEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AdministratorAccess" } } } ] } } }, "createdDate": "2019-12-09T23:52:37.000Z", "lastUpdatedDate": "2019-12-09T23:52:37.000Z" }, "CloudFormationStackSetsOrgAdminServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgAdminServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-10T00:20:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowsAWSOrganizationsReadAPIs", "Effect": "Allow", "Action": [ "organizations:List*", "organizations:Describe*" ], "Resource": "*" }, { "Sid": "AllowAssumeRoleInMemberAccounts", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/stacksets-exec-*" } ] } } }, "createdDate": "2019-12-10T00:20:05.000Z", "lastUpdatedDate": "2019-12-10T00:20:05.000Z" }, "Health_OrganizationsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/Health_OrganizationsServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2019-12-16T13:28:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:ListAccounts", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-07-19T14:34:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-06-08T12:48:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "organizations:ListAccounts", "Resource": "*" }, { "Sid": "ListAWSServiceAccessForOrganization0", "Effect": "Allow", "Action": "organizations:ListAWSServiceAccessForOrganization", "Resource": "*" } ] } }, "v4": { "createdDate": "2019-12-16T13:28:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "HealthAPIOrganizationView0", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-16T13:28:21.000Z", "lastUpdatedDate": "2024-02-06T16:07:08.000Z" }, "AWSImageBuilderReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSImageBuilderReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-19T22:29:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:Get*", "imagebuilder:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder" } ] } } }, "createdDate": "2019-12-19T22:29:23.000Z", "lastUpdatedDate": "2019-12-19T22:29:23.000Z" }, "AWSImageBuilderFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSImageBuilderFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-04-13T17:33:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:*imagebuilder*" }, { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/*imagebuilder*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:instance-profile/*imagebuilder*", "arn:aws:iam::*:role/*imagebuilder*" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3::*:*imagebuilder*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder", "Condition": { "StringLike": { "iam:AWSServiceName": "imagebuilder.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:DescribeVpcs", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeSubnets", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2019-12-20T18:25:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:*imagebuilder*" }, { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListLicenseSpecificationsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/*imagebuilder*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:instance-profile/*imagebuilder*", "arn:aws:iam::*:role/*imagebuilder*" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3::*:*imagebuilder*" }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder", "Condition": { "StringLike": { "iam:AWSServiceName": "imagebuilder.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:DescribeRegions", "ec2:DescribeVolumes", "ec2:DescribeSubnets", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups" ], "Resource": "*" } ] } } }, "createdDate": "2019-12-20T18:25:12.000Z", "lastUpdatedDate": "2021-04-13T17:33:42.000Z" }, "EC2FleetTimeShiftableServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/EC2FleetTimeShiftableServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2019-12-23T19:47:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSubnets", "ec2:DescribeInstances", "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2:fleet-id": "*" } } } ] } } }, "createdDate": "2019-12-23T19:47:15.000Z", "lastUpdatedDate": "2019-12-23T19:47:15.000Z" }, "AmazonRekognitionCustomLabelsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRekognitionCustomLabelsFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2020-04-17T17:26:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": "arn:aws:s3:::*custom-labels*" }, { "Effect": "Allow", "Action": [ "rekognition:CreateProject", "rekognition:CreateProjectVersion", "rekognition:StartProjectVersion", "rekognition:StopProjectVersion", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DeleteProject", "rekognition:DeleteProjectVersion" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-03T02:53:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": "arn:aws:s3:::*custom-labels*" }, { "Effect": "Allow", "Action": [ "rekognition:CreateProject", "rekognition:CreateProjectVersion", "rekognition:StartProjectVersion", "rekognition:StopProjectVersion", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DeleteProject", "rekognition:DeleteProjectVersion", "rekognition:TagResource", "rekognition:UntagResource", "rekognition:ListTagsForResource", "rekognition:CreateDataset", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset", "rekognition:UpdateDatasetEntries", "rekognition:DistributeDatasetEntries", "rekognition:DeleteDataset" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-01-08T19:18:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": "arn:aws:s3:::*custom-labels*" }, { "Effect": "Allow", "Action": [ "rekognition:CreateProject", "rekognition:CreateProjectVersion", "rekognition:StartProjectVersion", "rekognition:StopProjectVersion", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-08-16T20:20:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": "arn:aws:s3:::*custom-labels*" }, { "Effect": "Allow", "Action": [ "rekognition:CreateProject", "rekognition:CreateProjectVersion", "rekognition:StartProjectVersion", "rekognition:StopProjectVersion", "rekognition:DescribeProjects", "rekognition:DescribeProjectVersions", "rekognition:DetectCustomLabels", "rekognition:DeleteProject", "rekognition:DeleteProjectVersion", "rekognition:TagResource", "rekognition:UntagResource", "rekognition:ListTagsForResource", "rekognition:CreateDataset", "rekognition:ListDatasetEntries", "rekognition:ListDatasetLabels", "rekognition:DescribeDataset", "rekognition:UpdateDatasetEntries", "rekognition:DistributeDatasetEntries", "rekognition:DeleteDataset", "rekognition:CopyProjectVersion", "rekognition:PutProjectPolicy", "rekognition:ListProjectPolicies", "rekognition:DeleteProjectPolicy" ], "Resource": "*" } ] } } }, "createdDate": "2020-01-08T19:18:34.000Z", "lastUpdatedDate": "2022-08-16T20:20:43.000Z" }, "AmazonWorkDocsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkDocsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-08T23:49:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workdocs:Describe*", "ds:DescribeDirectories", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" } ] } } }, "createdDate": "2020-01-08T23:49:59.000Z", "lastUpdatedDate": "2020-01-08T23:49:59.000Z" }, "AmazonElasticFileSystemClientReadWriteAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadWriteAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-13T16:21:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" } ] } } }, "createdDate": "2020-01-13T16:21:55.000Z", "lastUpdatedDate": "2020-01-13T16:21:55.000Z" }, "AmazonElasticFileSystemClientReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-13T16:24:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:ClientMount", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" } ] } } }, "createdDate": "2020-01-13T16:24:36.000Z", "lastUpdatedDate": "2020-01-13T16:24:36.000Z" }, "AmazonElasticFileSystemClientFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemClientFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-13T16:27:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:ClientMount", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:ClientWrite", "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" } ] } } }, "createdDate": "2020-01-13T16:27:00.000Z", "lastUpdatedDate": "2020-01-13T16:27:00.000Z" }, "AWSQuickSightSageMakerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightSageMakerPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-01-17T17:18:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:CreateTransformJob" ], "Resource": "arn:aws:sagemaker:*:*:transform-job/quicksight-auto-generated-*" }, { "Effect": "Allow", "Action": "sagemaker:ListModels", "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::quicksight-ml.*" } ] } }, "v2": { "createdDate": "2020-01-17T17:18:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:CreateTransformJob" ], "Resource": "arn:aws:sagemaker:*:*:transform-job/quicksight-auto-generated-*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListModels", "sagemaker:DescribeModel" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::quicksight-ml.*", "arn:aws:s3:::sagemaker*" ] }, { "Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::sagemaker*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::sagemaker*" } ] } }, "v3": { "createdDate": "2020-01-17T17:18:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerTransformJobAccess", "Effect": "Allow", "Action": [ "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:CreateTransformJob" ], "Resource": "arn:aws:sagemaker:*:*:transform-job/quicksight-auto-generated-*" }, { "Sid": "SageMakerModelReadAccess", "Effect": "Allow", "Action": [ "sagemaker:ListModels", "sagemaker:DescribeModel" ], "Resource": "*" }, { "Sid": "S3ObjectReadAccess", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::quicksight-ml.*", "arn:aws:s3:::sagemaker*" ] }, { "Sid": "S3ObjectUpdateAccess", "Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::sagemaker*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3BucketReadAccess", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::sagemaker*" } ] } } }, "createdDate": "2020-01-17T17:18:13.000Z", "lastUpdatedDate": "2023-10-30T17:57:43.000Z" }, "AmazonManagedBlockchainServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonManagedBlockchainServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-17T19:51:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/managedblockchain/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/managedblockchain/*:log-stream:*" ] } ] } } }, "createdDate": "2020-01-17T19:51:28.000Z", "lastUpdatedDate": "2020-01-17T19:51:28.000Z" }, "AWSAppSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAppSyncServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-01-21T19:56:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingTargets", "xray:GetSamplingRules", "xray:GetSamplingStatisticSummaries" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-01-21T19:56:53.000Z", "lastUpdatedDate": "2020-01-21T19:56:53.000Z" }, "AmazonChimeSDK": { "arn": "arn:aws:iam::aws:policy/AmazonChimeSDK", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2020-02-04T21:53:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:CreateMeeting", "chime:DeleteMeeting", "chime:GetMeeting", "chime:ListMeetings", "chime:CreateAttendee", "chime:BatchCreateAttendee", "chime:DeleteAttendee", "chime:GetAttendee", "chime:ListAttendees" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-04-08T21:18:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:CreateMeeting", "chime:DeleteMeeting", "chime:GetMeeting", "chime:ListMeetings", "chime:CreateAttendee", "chime:BatchCreateAttendee", "chime:DeleteAttendee", "chime:GetAttendee", "chime:ListAttendees", "chime:ListAttendeeTags", "chime:ListMeetingTags", "chime:ListTagsForResource", "chime:TagAttendee", "chime:TagMeeting", "chime:TagResource", "chime:UntagAttendee", "chime:UntagMeeting", "chime:UntagResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-09-18T21:07:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "chime:CreateMeeting", "chime:CreateMeetingWithAttendees", "chime:DeleteMeeting", "chime:GetMeeting", "chime:ListMeetings", "chime:CreateAttendee", "chime:BatchCreateAttendee", "chime:DeleteAttendee", "chime:GetAttendee", "chime:ListAttendees", "chime:ListAttendeeTags", "chime:ListMeetingTags", "chime:ListTagsForResource", "chime:TagAttendee", "chime:TagMeeting", "chime:TagResource", "chime:UntagAttendee", "chime:UntagMeeting", "chime:UntagResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2021-10-21T18:04:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:CreateMeeting", "chime:CreateMeetingWithAttendees", "chime:DeleteMeeting", "chime:GetMeeting", "chime:ListMeetings", "chime:CreateAttendee", "chime:BatchCreateAttendee", "chime:DeleteAttendee", "chime:GetAttendee", "chime:ListAttendees", "chime:ListAttendeeTags", "chime:ListMeetingTags", "chime:ListTagsForResource", "chime:TagAttendee", "chime:TagMeeting", "chime:TagResource", "chime:UntagAttendee", "chime:UntagMeeting", "chime:UntagResource", "chime:StartMeetingTranscription", "chime:StopMeetingTranscription" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-01-10T18:05:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:CreateMeeting", "chime:CreateMeetingWithAttendees", "chime:DeleteMeeting", "chime:GetMeeting", "chime:ListMeetings", "chime:CreateAttendee", "chime:BatchCreateAttendee", "chime:DeleteAttendee", "chime:GetAttendee", "chime:ListAttendees", "chime:ListAttendeeTags", "chime:ListMeetingTags", "chime:ListTagsForResource", "chime:TagAttendee", "chime:TagMeeting", "chime:TagResource", "chime:UntagAttendee", "chime:UntagMeeting", "chime:UntagResource", "chime:StartMeetingTranscription", "chime:StopMeetingTranscription", "chime:CreateMediaCapturePipeline", "chime:CreateMediaConcatenationPipeline", "chime:CreateMediaLiveConnectorPipeline", "chime:DeleteMediaCapturePipeline", "chime:DeleteMediaPipeline", "chime:GetMediaCapturePipeline", "chime:GetMediaPipeline", "chime:ListMediaCapturePipelines", "chime:ListMediaPipelines" ], "Resource": "*" } ] } } }, "createdDate": "2020-02-04T21:53:37.000Z", "lastUpdatedDate": "2023-01-10T18:05:12.000Z" }, "AWSIoTDeviceTesterForFreeRTOSFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTDeviceTesterForFreeRTOSFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2020-02-12T20:33:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "freertos:ListHardwarePlatforms", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/idt*", "arn:aws:signer:*::/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] } ] } }, "v2": { "createdDate": "2020-02-18T18:05:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "freertos:ListHardwarePlatforms", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] } ] } }, "v3": { "createdDate": "2020-03-23T19:49:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "freertos:ListHardwarePlatforms", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] } ] } }, "v5": { "createdDate": "2020-12-15T18:03:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "freertos:ListHardwarePlatforms", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:CancelJobExecution" ], "Resource": [ "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:thing/idt*" ] }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor8", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor9", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor10", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "VisualEditor11", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor12", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ssm:DescribeParameters", "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VisualEditor13", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateSecurityGroup" ], "aws:TagKeys": [ "Owner" ] } } } ] } }, "v4": { "createdDate": "2020-07-17T17:09:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "freertos:ListHardwarePlatforms", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:CancelJobExecution" ], "Resource": [ "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:thing/idt*" ] } ] } }, "v7": { "createdDate": "2023-08-10T20:30:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:CancelJobExecution" ], "Resource": [ "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:thing/idt*" ] }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor8", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor9", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor10", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "VisualEditor11", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor12", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ssm:DescribeParameters", "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VisualEditor13", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "Owner" ] }, "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateSecurityGroup" ] } } } ] } }, "v6": { "createdDate": "2023-06-02T22:01:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iot:DeleteThing", "iot:AttachThingPrincipal", "iot:DeleteCertificate", "iot:GetRegistrationCode", "iot:CreatePolicy", "iot:UpdateCACertificate", "s3:ListBucket", "iot:DescribeEndpoint", "iot:CreateOTAUpdate", "iot:CreateStream", "signer:ListSigningJobs", "acm:ListCertificates", "iot:CreateKeysAndCertificate", "iot:UpdateCertificate", "iot:CreateCertificateFromCsr", "iot:DetachThingPrincipal", "iot:RegisterCACertificate", "iot:CreateThing", "iam:ListRoles", "iot:RegisterCertificate", "iot:DeleteCACertificate", "signer:PutSigningProfile", "s3:ListAllMyBuckets", "signer:ListSigningPlatforms", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "iam:GetRole", "signer:StartSigningJob", "acm:GetCertificate", "signer:DescribeSigningJob", "s3:CreateBucket", "execute-api:Invoke", "s3:DeleteBucket", "s3:PutBucketVersioning", "signer:CancelSigningProfile" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:signer:*:*:/signing-profiles/*", "arn:aws:signer:*:*:/signing-jobs/*", "arn:aws:iam::*:role/idt-*", "arn:aws:acm:*:*:certificate/*", "arn:aws:s3:::idt-*", "arn:aws:s3:::afr-ota*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:DeleteStream", "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy", "s3:ListBucketVersions", "iot:UpdateCertificate", "iot:GetOTAUpdate", "iot:DeleteOTAUpdate", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*", "arn:aws:iot:*:*:thinggroup/idt*", "arn:aws:iam::*:role/idt-*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:DeleteCertificate", "iot:AttachPolicy", "iot:DetachPolicy", "s3:DeleteObjectVersion", "iot:DeleteOTAUpdate", "s3:PutObject", "s3:GetObject", "iot:DeleteStream", "iot:DeletePolicy", "s3:DeleteObject", "iot:UpdateCertificate", "iot:GetOTAUpdate", "s3:GetObjectVersion", "iot:DescribeJobExecution" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*", "arn:aws:iot:*:*:policy/idt*", "arn:aws:iam::*:role/idt-*", "arn:aws:iot:*:*:otaupdate/idt*", "arn:aws:iot:*:*:thing/idt*", "arn:aws:iot:*:*:cert/*", "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:stream/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::afr-ota*/*", "arn:aws:s3:::idt-*/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:CancelJobExecution" ], "Resource": [ "arn:aws:iot:*:*:job/*", "arn:aws:iot:*:*:thing/idt*" ] }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor8", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor9", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor10", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "VisualEditor11", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Owner": "IoTDeviceTester" } } }, { "Sid": "VisualEditor12", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ssm:DescribeParameters", "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "VisualEditor13", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateSecurityGroup" ], "aws:TagKeys": [ "Owner" ] } } } ] } } }, "createdDate": "2020-02-12T20:33:53.000Z", "lastUpdatedDate": "2023-08-10T20:30:07.000Z" }, "AWSIoTDeviceTesterForGreengrassFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTDeviceTesterForGreengrassFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-02-20T21:21:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "iot.amazonaws.com", "lambda.amazonaws.com", "greengrass.amazonaws.com" ] } } }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "iot:DeleteCertificate", "lambda:DeleteFunction", "execute-api:Invoke", "iot:UpdateCertificate" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:lambda:*:*:function:idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "iot:CreateJob", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:job/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint", "greengrass:*", "iam:ListAttachedRolePolicies", "iot:CreatePolicy", "iot:GetThingShadow", "iot:CreateKeysAndCertificate", "iot:ListThings", "iot:UpdateThingShadow", "iot:CreateCertificateFromCsr" ], "Resource": "*" }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "iot:DetachThingPrincipal", "iot:AttachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] } ] } }, "v3": { "createdDate": "2020-03-23T21:12:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "iot.amazonaws.com", "lambda.amazonaws.com", "greengrass.amazonaws.com" ] } } }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "iot:DeleteCertificate", "lambda:DeleteFunction", "execute-api:Invoke", "iot:UpdateCertificate" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:lambda:*:*:function:idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "iot:CreateJob", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:job/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint", "greengrass:*", "iam:ListAttachedRolePolicies", "iot:CreatePolicy", "iot:GetThingShadow", "iot:CreateKeysAndCertificate", "iot:ListThings", "iot:UpdateThingShadow", "iot:CreateCertificateFromCsr", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "iot:DetachThingPrincipal", "iot:AttachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] } ] } }, "v2": { "createdDate": "2020-02-26T18:26:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "iot.amazonaws.com", "lambda.amazonaws.com", "greengrass.amazonaws.com" ] } } }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "iot:DeleteCertificate", "lambda:DeleteFunction", "execute-api:Invoke", "iot:UpdateCertificate" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:lambda:*:*:function:idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "iot:CreateJob", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:job/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint", "greengrass:*", "iam:ListAttachedRolePolicies", "iot:CreatePolicy", "iot:GetThingShadow", "iot:CreateKeysAndCertificate", "iot:ListThings", "iot:UpdateThingShadow", "iot:CreateCertificateFromCsr", "iot-device-tester:SendMetrics" ], "Resource": "*" }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "iot:DetachThingPrincipal", "iot:AttachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] } ] } }, "v4": { "createdDate": "2020-06-25T17:01:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/idt-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "iot.amazonaws.com", "lambda.amazonaws.com", "greengrass.amazonaws.com" ] } } }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "iot:DeleteCertificate", "lambda:DeleteFunction", "execute-api:Invoke", "iot:UpdateCertificate" ], "Resource": [ "arn:aws:execute-api:us-east-1:098862408343:9xpmnvs5h4/prod/POST/metrics", "arn:aws:lambda:*:*:function:idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": [ "iot:AttachPolicy", "iot:DetachPolicy", "iot:DeletePolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": [ "iot:CreateJob", "iot:DescribeJob", "iot:DescribeJobExecution", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:job/*" ] }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint", "greengrass:*", "iam:ListAttachedRolePolicies", "iot:CreatePolicy", "iot:GetThingShadow", "iot:CreateKeysAndCertificate", "iot:ListThings", "iot:UpdateThingShadow", "iot:CreateCertificateFromCsr", "iot-device-tester:SendMetrics", "iot-device-tester:SupportedVersion", "iot-device-tester:LatestIdt", "iot-device-tester:CheckVersion", "iot-device-tester:DownloadTestSuite" ], "Resource": "*" }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "iot:DetachThingPrincipal", "iot:AttachThingPrincipal" ], "Resource": [ "arn:aws:iot:*:*:thing/idt-*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "VisualEditor8", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:DeleteObjectVersion", "s3:ListBucketVersions", "s3:CreateBucket", "s3:DeleteObject", "s3:DeleteBucket" ], "Resource": "arn:aws:s3:::idt*" } ] } } }, "createdDate": "2020-02-20T21:21:27.000Z", "lastUpdatedDate": "2020-06-25T17:01:56.000Z" }, "AmazonEKSServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2020-02-21T20:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateNetworkInterfacePermission", "iam:ListAttachedRolePolicies", "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ], "aws:RequestTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" } ] } }, "v2": { "createdDate": "2020-05-27T19:30:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateNetworkInterfacePermission", "iam:ListAttachedRolePolicies", "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "ForAnyValue:StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ], "aws:RequestTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" } ] } }, "v3": { "createdDate": "2020-02-21T20:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateNetworkInterfacePermission", "iam:ListAttachedRolePolicies", "ec2:CreateSecurityGroup", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "eks-cluster-*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" } ] } }, "v4": { "createdDate": "2020-02-21T20:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateNetworkInterfacePermission", "iam:ListAttachedRolePolicies", "ec2:CreateSecurityGroup", "ec2:GetSecurityGroupsForVpc" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "eks-cluster-*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AWS/EKS" } } } ] } }, "v5": { "createdDate": "2020-02-21T20:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterfacePermission" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "eks:DescribeCluster", "elasticloadbalancing:DescribeListenerAttributes", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTrustStores", "iam:ListAttachedRolePolicies", "pricing:GetProducts", "shield:GetSubscriptionState", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "eks-cluster-*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AWS/EKS" } } }, { "Effect": "Allow", "Action": [ "eks:CreateAccessEntry", "eks:DeleteAccessEntry" ], "Resource": "*", "Condition": { "StringEquals": { "eks:accessEntryType": "STANDARD" }, "ArnLike": { "eks:principalArn": "arn:aws:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS" } } }, { "Effect": "Allow", "Action": [ "eks:ListAssociatedAccessPolicies" ], "Resource": "arn:aws:eks:*:*:access-entry/*/role/${aws:PrincipalAccount}/AWSServiceRoleForAmazonEKS/*" }, { "Effect": "Allow", "Action": [ "eks:AssociateAccessPolicy", "eks:DisassociateAccessPolicy" ], "Resource": "arn:aws:eks:*:*:access-entry/*/role/${aws:PrincipalAccount}/AWSServiceRoleForAmazonEKS/*", "Condition": { "StringEquals": { "eks:policyArn": [ "arn:aws:eks::aws:cluster-access-policy/AmazonEKSComputePolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSComputeClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSNetworkingPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSNetworkingClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSLoadBalancingPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSLoadBalancingClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStoragePolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStorageClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSHybridPolicy" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": "eks:DescribeAccessEntry", "Resource": "*", "Condition": { "StringEquals": { "eks:accessEntryType": "EC2" } } }, { "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/EKS*", "Condition": { "ForAllValues:StringEquals": { "events:source": [ "aws.ec2", "aws.health" ] }, "StringEquals": { "events:ManagedBy": [ "eks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "events:PutTargets", "Resource": "arn:aws:events:*:*:rule/EKS*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteTargetGroup", "ec2:DeleteSecurityGroup", "shield:DescribeProtection" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } } ] } }, "v6": { "createdDate": "2020-02-21T20:10:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateSecurityGroup", "ec2:CreateNetworkInterfacePermission" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "eks:DescribeCluster", "elasticloadbalancing:DescribeListenerAttributes", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTrustStores", "iam:ListAttachedRolePolicies", "pricing:GetProducts", "shield:GetSubscriptionState", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "ec2:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/Name": "eks-cluster-*" } } }, { "Effect": "Allow", "Action": "route53:AssociateVPCWithHostedZone", "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*:*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AWS/EKS" } } }, { "Effect": "Allow", "Action": [ "eks:CreateAccessEntry", "eks:DeleteAccessEntry" ], "Resource": "*", "Condition": { "StringEquals": { "eks:accessEntryType": "STANDARD" }, "ArnLike": { "eks:principalArn": "arn:aws:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS" } } }, { "Effect": "Allow", "Action": [ "eks:ListAssociatedAccessPolicies" ], "Resource": "arn:aws:eks:*:*:access-entry/*/role/${aws:PrincipalAccount}/AWSServiceRoleForAmazonEKS/*" }, { "Effect": "Allow", "Action": [ "eks:AssociateAccessPolicy", "eks:DisassociateAccessPolicy" ], "Resource": "arn:aws:eks:*:*:access-entry/*/role/${aws:PrincipalAccount}/AWSServiceRoleForAmazonEKS/*", "Condition": { "StringEquals": { "eks:policyArn": [ "arn:aws:eks::aws:cluster-access-policy/AmazonEKSComputePolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSComputeClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSNetworkingPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSNetworkingClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSLoadBalancingPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSLoadBalancingClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStoragePolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStorageClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSHybridPolicy" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": "eks:DescribeAccessEntry", "Resource": "*", "Condition": { "StringEquals": { "eks:accessEntryType": "EC2" } } }, { "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/EKS*", "Condition": { "ForAllValues:StringEquals": { "events:source": [ "aws.ec2", "aws.health" ] }, "StringEquals": { "events:ManagedBy": [ "eks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "events:PutTargets", "Resource": "arn:aws:events:*:*:rule/EKS*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ManagedResourceOperator": [ "eks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteTargetGroup", "ec2:DeleteSecurityGroup", "shield:DescribeProtection" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks:eks-cluster-name": "*" } } } ] } } }, "createdDate": "2020-02-21T20:10:47.000Z", "lastUpdatedDate": "2025-02-26T21:37:06.000Z" }, "ComputeOptimizerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v2": { "createdDate": "2020-11-04T20:57:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "ec2:DescribeInstances", "autoscaling:DescribeAutoScalingGroups", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-03-07T00:11:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "ec2:DescribeInstances", "autoscaling:DescribeAutoScalingGroups", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-23T18:00:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "ec2:DescribeInstances", "ec2:DescribeVolumes", "autoscaling:DescribeAutoScalingGroups", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-08-26T18:34:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "ec2:DescribeInstances", "ec2:DescribeVolumes", "autoscaling:DescribeAutoScalingGroups", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-29T16:03:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetEffectiveRecommendationPreferences", "ec2:DescribeInstances", "ec2:DescribeVolumes", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-12-22T17:34:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:ListServices", "ecs:ListClusters", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2020-03-07T00:11:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetLicenseRecommendations", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:ListServices", "ecs:ListClusters", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-03-07T00:11:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "computeOptimizerReadOnlyAccess", "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetLicenseRecommendations", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:ListServices", "ecs:ListClusters", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-03-07T00:11:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "computeOptimizerReadOnlyAccess", "Effect": "Allow", "Action": [ "compute-optimizer:DescribeRecommendationExportJobs", "compute-optimizer:GetEnrollmentStatus", "compute-optimizer:GetEnrollmentStatusesForOrganization", "compute-optimizer:GetRecommendationSummaries", "compute-optimizer:GetEC2InstanceRecommendations", "compute-optimizer:GetEC2RecommendationProjectedMetrics", "compute-optimizer:GetAutoScalingGroupRecommendations", "compute-optimizer:GetEBSVolumeRecommendations", "compute-optimizer:GetLambdaFunctionRecommendations", "compute-optimizer:GetRecommendationPreferences", "compute-optimizer:GetEffectiveRecommendationPreferences", "compute-optimizer:GetECSServiceRecommendations", "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", "compute-optimizer:GetRDSDatabaseRecommendations", "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", "compute-optimizer:GetLicenseRecommendations", "compute-optimizer:GetIdleRecommendations", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ecs:ListServices", "ecs:ListClusters", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "lambda:ListFunctions", "lambda:ListProvisionedConcurrencyConfigs", "cloudwatch:GetMetricData", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" } ] } } }, "createdDate": "2020-03-07T00:11:02.000Z", "lastUpdatedDate": "2024-11-20T21:08:59.000Z" }, "AWSApplicationAutoscalingCassandraTablePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingCassandraTablePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-03-18T22:49:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cassandra:Select", "Resource": [ "arn:*:cassandra:*:*:/keyspace/system/table/*", "arn:*:cassandra:*:*:/keyspace/system_schema/table/*", "arn:*:cassandra:*:*:/keyspace/system_schema_mcs/table/*" ] }, { "Effect": "Allow", "Action": [ "cassandra:Alter", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": "*" } ] } } }, "createdDate": "2020-03-18T22:49:23.000Z", "lastUpdatedDate": "2020-03-18T22:49:23.000Z" }, "ElementalAppliancesSoftwareReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ElementalAppliancesSoftwareReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-04-01T22:31:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-appliances-software:List*", "elemental-appliances-software:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2020-04-01T22:31:09.000Z", "lastUpdatedDate": "2020-04-01T22:31:09.000Z" }, "GameLiftGameServerGroupPolicy": { "arn": "arn:aws:iam::aws:policy/GameLiftGameServerGroupPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-04-03T23:12:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:ResumeProcesses", "autoscaling:EnterStandby", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:DetachInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "autoscaling:DescribeAutoScalingGroups", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sns:Publish", "Resource": [ "arn:aws:sns:*:*:ActivatingLifecycleHookTopic-*", "arn:aws:sns:*:*:TerminatingLifecycleHookTopic-*" ] } ] } }, "v2": { "createdDate": "2020-04-16T17:13:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:ResumeProcesses", "autoscaling:EnterStandby", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:DetachInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "autoscaling:DescribeAutoScalingGroups", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sns:Publish", "Resource": [ "arn:*:sns:*:*:ActivatingLifecycleHookTopic-*", "arn:*:sns:*:*:TerminatingLifecycleHookTopic-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/GameLift" } } } ] } }, "v3": { "createdDate": "2020-05-13T17:27:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CompleteLifecycleAction", "autoscaling:ResumeProcesses", "autoscaling:EnterStandby", "autoscaling:SetInstanceProtection", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:DetachInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/GameLift": "GameServerGroups" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "autoscaling:DescribeAutoScalingGroups", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "sns:Publish", "Resource": [ "arn:*:sns:*:*:ActivatingLifecycleHookTopic-*", "arn:*:sns:*:*:TerminatingLifecycleHookTopic-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/GameLift" } } } ] } } }, "createdDate": "2020-04-03T23:12:19.000Z", "lastUpdatedDate": "2020-05-13T17:27:43.000Z" }, "AWSWAFConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSWAFConsoleFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v2": { "createdDate": "2020-10-01T20:13:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v1": { "createdDate": "2020-04-06T18:38:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-15T19:33:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*", "arn:aws:logs:*:*:aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:aws-waf-logs-*" ], "Effect": "Allow" } ] } }, "v4": { "createdDate": "2022-01-11T19:34:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*", "s3:ListAllMyBuckets", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2022-08-25T20:13:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*", "s3:ListAllMyBuckets", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:ListUserPools", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2023-03-30T20:56:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*", "s3:ListAllMyBuckets", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:ListUserPools", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2023-05-31T19:11:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*", "s3:ListAllMyBuckets", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:ListUserPools", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "ec2:AssociateVerifiedAccessInstanceWebAcl", "ec2:DisassociateVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2023-06-05T20:56:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUseOfAWSWAF", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:SetWebACL", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudfront:UpdateDistribution", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:SetWebACL", "appsync:ListGraphqlApis", "appsync:SetWebACL", "waf-regional:*", "waf:*", "wafv2:*", "s3:ListAllMyBuckets", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "cognito-idp:ListUserPools", "cognito-idp:AssociateWebACL", "cognito-idp:DisassociateWebACL", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:AssociateWebAcl", "apprunner:DisassociateWebAcl", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "apprunner:ListAssociatedServicesForWebAcl", "ec2:AssociateVerifiedAccessInstanceWebAcl", "ec2:DisassociateVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstances" ], "Resource": "*" }, { "Sid": "AllowLogDeliverySubscription", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForS3Bucket", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-waf-logs-*" ], "Effect": "Allow" }, { "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup", "Action": [ "logs:PutResourcePolicy" ], "Resource": "*", "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-04-06T18:38:38.000Z", "lastUpdatedDate": "2023-06-05T20:56:03.000Z" }, "AWSWAFConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSWAFConsoleReadOnlyAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2020-04-06T18:43:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v4": { "createdDate": "2022-08-25T20:13:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "appsync:ListGraphqlApis", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity", "cognito-idp:ListUserPools", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource" ], "Effect": "Allow", "Resource": "*" } ] } }, "v3": { "createdDate": "2020-10-01T20:13:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "appsync:ListGraphqlApis", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-06-22T22:38:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity" ], "Effect": "Allow", "Resource": "*" } ] } }, "v5": { "createdDate": "2023-03-30T20:59:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "appsync:ListGraphqlApis", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity", "cognito-idp:ListUserPools", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices" ], "Effect": "Allow", "Resource": "*" } ] } }, "v6": { "createdDate": "2023-05-31T19:12:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "appsync:ListGraphqlApis", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity", "cognito-idp:ListUserPools", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl" ], "Effect": "Allow", "Resource": "*" } ] } }, "v7": { "createdDate": "2023-06-05T20:56:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "apigateway:GET", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByWebACLId", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeRegions", "elasticloadbalancing:DescribeLoadBalancers", "appsync:ListGraphqlApis", "waf-regional:Get*", "waf-regional:List*", "waf:Get*", "waf:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "wafv2:CheckCapacity", "cognito-idp:ListUserPools", "cognito-idp:ListResourcesForWebACL", "cognito-idp:GetWebACLForResource", "apprunner:DescribeWebAclForService", "apprunner:ListServices", "apprunner:ListAssociatedServicesForWebAcl", "ec2:DescribeVerifiedAccessInstanceWebAclAssociations", "ec2:GetVerifiedAccessInstanceWebAcl", "ec2:DescribeVerifiedAccessInstances" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-04-06T18:43:24.000Z", "lastUpdatedDate": "2023-06-05T20:56:51.000Z" }, "AmazonWorkDocsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkDocsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-04-16T23:05:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workdocs:*", "ds:DescribeDirectories", "ec2:DescribeVpcs", "ec2:DescribeSubnets" ], "Resource": "*" } ] } } }, "createdDate": "2020-04-16T23:05:11.000Z", "lastUpdatedDate": "2020-04-16T23:05:11.000Z" }, "AmazonAugmentedAIIntegratedAPIAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAugmentedAIIntegratedAPIAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-04-22T20:47:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*HumanLoop", "sagemaker:*HumanLoops", "sagemaker:*FlowDefinition", "sagemaker:*FlowDefinitions", "sagemaker:*HumanTaskUi", "sagemaker:*HumanTaskUis" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Effect": "Allow", "Action": [ "textract:AnalyzeDocument" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rekognition:DetectModerationLabels" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-04-22T20:47:32.000Z", "lastUpdatedDate": "2020-04-22T20:47:32.000Z" }, "AmazonKeyspacesFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKeyspacesFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2020-04-23T17:06:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-06-01T19:31:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-07-07T15:02:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2023-06-05T15:21:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/replication.cassandra.amazonaws.com/AWSServiceRoleForKeyspacesReplication", "Condition": { "StringLike": { "iam:AWSServiceName": "replication.cassandra.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-04-23T17:06:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CassandraFullAccess", "Effect": "Allow", "Action": [ "cassandra:*" ], "Resource": "*" }, { "Sid": "ApplicationAutoscalingFullAccess", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "CloudwatchAlarmsFullAccess", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:PutMetricAlarm" ], "Resource": "*" }, { "Sid": "ApplicationAutoscalingServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_CassandraTable", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra.application-autoscaling.amazonaws.com" } } }, { "Sid": "KeyspacesReplicationServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/replication.cassandra.amazonaws.com/AWSServiceRoleForKeyspacesReplication", "Condition": { "StringLike": { "iam:AWSServiceName": "replication.cassandra.amazonaws.com" } } }, { "Sid": "Ec2VpcReadAccess", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcEndpoints" ], "Resource": "*" } ] } } }, "createdDate": "2020-04-23T17:06:37.000Z", "lastUpdatedDate": "2023-10-03T19:12:30.000Z" }, "AmazonKeyspacesReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-04-23T17:07:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-06-01T19:32:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-07-07T14:54:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" } ] } } }, "createdDate": "2020-04-23T17:07:14.000Z", "lastUpdatedDate": "2022-07-07T14:54:05.000Z" }, "AmazonDetectiveFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDetectiveFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2020-10-21T22:07:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:*", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings" ], "Resource": "arn:aws:guardduty:*:*:detector/*" }, { "Effect": "Allow", "Action": [ "guardduty:ListDetectors" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-04-30T17:57:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:*", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings" ], "Resource": "arn:aws:guardduty:*:*:detector/*" } ] } }, "v4": { "createdDate": "2023-05-17T19:39:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:*", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings" ], "Resource": "arn:aws:guardduty:*:*:detector/*" }, { "Effect": "Allow", "Action": [ "guardduty:GetFindings", "guardduty:ListDetectors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "securityHub:GetFindings" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-01-17T14:35:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:*", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings" ], "Resource": "arn:aws:guardduty:*:*:detector/*" }, { "Effect": "Allow", "Action": [ "guardduty:GetFindings", "guardduty:ListDetectors" ], "Resource": "*" } ] } } }, "createdDate": "2020-04-30T17:57:15.000Z", "lastUpdatedDate": "2023-05-17T19:39:57.000Z" }, "AWSPurchaseOrdersServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSPurchaseOrdersServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2020-05-06T18:15:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "awsbillingconsole:*Billing", "purchase-orders:*PurchaseOrders" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-22T20:06:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:*Billing", "purchase-orders:*PurchaseOrders" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-03-07T22:32:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetContactInformation", "aws-portal:*Billing", "payments:GetPaymentInstrument", "payments:ListPaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:ViewPurchaseOrders", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-03-17T19:07:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetContactInformation", "aws-portal:*Billing", "consolidatedbilling:GetAccountBillingRole", "invoicing:GetInvoicePDF", "payments:GetPaymentInstrument", "payments:ListPaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:ViewPurchaseOrders", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-07-17T18:59:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetContactInformation", "aws-portal:*Billing", "consolidatedbilling:GetAccountBillingRole", "invoicing:GetInvoicePDF", "payments:GetPaymentInstrument", "payments:ListPaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-05-06T18:15:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:GetAccountInformation", "account:GetContactInformation", "aws-portal:*Billing", "consolidatedbilling:GetAccountBillingRole", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceUnits", "payments:GetPaymentInstrument", "payments:ListPaymentPreferences", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "purchase-orders:ModifyPurchaseOrders", "purchase-orders:TagResource", "purchase-orders:UntagResource", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus", "purchase-orders:ViewPurchaseOrders", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } } }, "createdDate": "2020-05-06T18:15:47.000Z", "lastUpdatedDate": "2024-12-01T17:51:06.000Z" }, "ServerMigrationServiceConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/ServerMigrationServiceConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-05-09T17:18:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sms:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:DescribeStackResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "s3:ListAllMyBuckets", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::sms-app-*/*" }, { "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "sms.amazonaws.com" } }, "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-07-20T22:00:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sms:*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:DescribeStackResources" ], "Effect": "Allow", "Resource": "*" }, { "Action": "s3:ListAllMyBuckets", "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::sms-app-*/*" }, { "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:ListRoles" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "sms.amazonaws.com" } }, "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" } ] } } }, "createdDate": "2020-05-09T17:18:57.000Z", "lastUpdatedDate": "2020-07-20T22:00:37.000Z" }, "AWSBackupServiceLinkedRolePolicyForBackupTest": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackupTest", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-12T17:37:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-05-12T17:37:29.000Z", "lastUpdatedDate": "2020-05-12T17:37:29.000Z" }, "AmazonSSMPatchAssociation": { "arn": "arn:aws:iam::aws:policy/AmazonSSMPatchAssociation", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-13T16:00:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ssm:DescribeEffectivePatchesForPatchBaseline", "Resource": "arn:aws:ssm:*:*:patchbaseline/*" }, { "Effect": "Allow", "Action": "ssm:GetPatchBaseline", "Resource": "arn:aws:ssm:*:*:patchbaseline/*" }, { "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DescribePatchBaselines", "Resource": "*" } ] } } }, "createdDate": "2020-05-13T16:00:42.000Z", "lastUpdatedDate": "2020-05-13T16:00:42.000Z" }, "AWSCloud9SSMInstanceProfile": { "arn": "arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-14T11:40:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:UpdateInstanceInformation" ], "Resource": "*" } ] } } }, "createdDate": "2020-05-14T11:40:49.000Z", "lastUpdatedDate": "2020-05-14T11:40:49.000Z" }, "AWSCodeDeployRoleForCloudFormation": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForCloudFormation", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-19T17:12:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" } ] } } }, "createdDate": "2020-05-19T17:12:52.000Z", "lastUpdatedDate": "2020-05-19T17:12:52.000Z" }, "AWSIoTSiteWiseMonitorPortalAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTSiteWiseMonitorPortalAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-19T20:01:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:CreateProject", "iotsitewise:DescribeProject", "iotsitewise:UpdateProject", "iotsitewise:DeleteProject", "iotsitewise:ListProjects", "iotsitewise:BatchAssociateProjectAssets", "iotsitewise:BatchDisassociateProjectAssets", "iotsitewise:ListProjectAssets", "iotsitewise:CreateDashboard", "iotsitewise:DescribeDashboard", "iotsitewise:UpdateDashboard", "iotsitewise:DeleteDashboard", "iotsitewise:ListDashboards", "iotsitewise:CreateAccessPolicy", "iotsitewise:DescribeAccessPolicy", "iotsitewise:UpdateAccessPolicy", "iotsitewise:DeleteAccessPolicy", "iotsitewise:ListAccessPolicies", "iotsitewise:DescribeAsset", "iotsitewise:ListAssets", "iotsitewise:ListAssociatedAssets", "iotsitewise:DescribeAssetProperty", "iotsitewise:GetAssetPropertyValue", "iotsitewise:GetAssetPropertyValueHistory", "iotsitewise:GetAssetPropertyAggregates", "sso-directory:DescribeUsers" ], "Resource": "*" } ] } } }, "createdDate": "2020-05-19T20:01:21.000Z", "lastUpdatedDate": "2020-05-19T20:01:21.000Z" }, "AWSThinkboxAWSPortalGatewayPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxAWSPortalGatewayPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-05-27T19:05:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": "dynamodb:Scan", "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::stack*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw-stack*" ] } ] } }, "v2": { "createdDate": "2020-06-30T16:02:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": "dynamodb:Scan", "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::stack*" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::stack*/gateway_certs/*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw-stack*" ] } ] } } }, "createdDate": "2020-05-27T19:05:00.000Z", "lastUpdatedDate": "2020-06-30T16:02:07.000Z" }, "AWSThinkboxAWSPortalWorkerPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxAWSPortalWorkerPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-05-27T19:15:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWS*" ] } ] } }, "v2": { "createdDate": "2020-06-30T16:11:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::stack*/gateway_certs/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWS*" ] } ] } }, "v4": { "createdDate": "2020-12-07T23:27:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/DeadlineRole": "DeadlineRenderNode" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::stack*/gateway_certs/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWS*" ] } ] } }, "v3": { "createdDate": "2020-08-20T21:18:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ARN": "${ec2:SourceInstanceARN}" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::stack*/gateway_certs/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWS*" ] } ] } } }, "createdDate": "2020-05-27T19:15:05.000Z", "lastUpdatedDate": "2020-12-07T23:27:47.000Z" }, "AWSThinkboxAssetServerPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxAssetServerPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-27T19:18:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/thinkbox*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-portal-cache*" ] } ] } } }, "createdDate": "2020-05-27T19:18:53.000Z", "lastUpdatedDate": "2020-05-27T19:18:53.000Z" }, "AWSThinkboxDeadlineResourceTrackerAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxDeadlineResourceTrackerAccessPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-27T19:25:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:PutItem", "dynamodb:Scan", "dynamodb:UpdateItem", "dynamodb:UpdateTable" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "ec2:CancelSpotFleetRequests", "ec2:DeleteFleets", "ec2:DescribeFleetInstances", "ec2:DescribeFleets", "ec2:DescribeInstances", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/DeadlineTrackedAWSResource": "*" } } }, { "Effect": "Allow", "Action": [ "events:PutEvents" ], "Resource": [ "arn:aws:events:*:*:event-bus/default" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:ReceiveMessage" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeStateMessageQueue*" ] } ] } } }, "createdDate": "2020-05-27T19:25:05.000Z", "lastUpdatedDate": "2020-05-27T19:25:05.000Z" }, "AWSThinkboxDeadlineResourceTrackerAdminPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxDeadlineResourceTrackerAdminPolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2020-05-27T19:29:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v4": { "createdDate": "2021-08-12T21:28:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListTags", "lambda:PutFunctionConcurrency", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v3": { "createdDate": "2021-07-27T21:13:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionCode", "lambda:TagResource", "lambda:ListTags", "lambda:UntagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v5": { "createdDate": "2021-12-23T01:01:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:DeleteFunctionConcurrency", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListTags", "lambda:PutFunctionConcurrency", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v2": { "createdDate": "2020-10-06T19:06:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v6": { "createdDate": "2022-06-22T18:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:DeleteFunctionConcurrency", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListTags", "lambda:PutFunctionConcurrency", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v7": { "createdDate": "2020-05-27T19:29:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSThinkboxDeadlineResourceTracker1", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker2", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker3", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker4", "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker5", "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker6", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker7", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker8", "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker9", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker10", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker11", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker12", "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker13", "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "StringLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker14", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker15", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:DeleteFunctionConcurrency", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListTags", "lambda:PutFunctionConcurrency", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker16", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker17", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } }, "v8": { "createdDate": "2020-05-27T19:29:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSThinkboxDeadlineResourceTracker1", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker2", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker3", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:UpdateTerminationProtection", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker4", "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "dynamodb:TagResource", "dynamodb:UntagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeHealth*", "arn:aws:dynamodb:*:*:table/DeadlineEC2ComputeNodeInfo*", "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker5", "Effect": "Allow", "Action": [ "dynamodb:BatchWriteItem", "dynamodb:Scan" ], "Resource": [ "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker6", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker7", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker8", "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker9", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "dynamodb.application-autoscaling.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker10", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/DeadlineResourceTrackerAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker11", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "application-autoscaling.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker12", "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping" ], "Resource": [ "*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker13", "Effect": "Allow", "Action": [ "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping" ], "Resource": [ "*" ], "Condition": { "ArnLike": { "lambda:FunctionArn": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker14", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ], "Condition": { "StringLike": { "lambda:Principal": "events.amazonaws.com" } } }, { "Sid": "AWSThinkboxDeadlineResourceTracker15", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:DeleteFunctionConcurrency", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListTags", "lambda:PutFunctionConcurrency", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:DeadlineResourceTracker*" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker16", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" ] }, { "Sid": "AWSThinkboxDeadlineResourceTracker17", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:TagQueue", "sqs:UntagQueue" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*", "arn:aws:sqs:*:*:DeadlineResourceTracker*" ] } ] } } }, "createdDate": "2020-05-27T19:29:09.000Z", "lastUpdatedDate": "2024-11-12T19:29:09.000Z" }, "AWSThinkboxDeadlineSpotEventPluginWorkerPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxDeadlineSpotEventPluginWorkerPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-05-27T19:35:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ARN": "${ec2:SourceInstanceARN}" } } }, { "Effect": "Allow", "Action": [ "sqs:GetQueueUrl", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*" ] } ] } }, "v2": { "createdDate": "2020-12-07T23:31:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/DeadlineTrackedAWSResource": "SpotEventPlugin" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/DeadlineResourceTracker": "SpotEventPlugin" } } }, { "Effect": "Allow", "Action": [ "sqs:GetQueueUrl", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:DeadlineAWSComputeNodeState*" ] } ] } } }, "createdDate": "2020-05-27T19:35:00.000Z", "lastUpdatedDate": "2020-12-07T23:31:31.000Z" }, "AWSThinkboxDeadlineSpotEventPluginAdminPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxDeadlineSpotEventPluginAdminPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-05-27T19:38:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CancelSpotFleetRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:RequestSpotFleet" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/*" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } } ] } } }, "createdDate": "2020-05-27T19:38:34.000Z", "lastUpdatedDate": "2020-05-27T19:38:34.000Z" }, "AWSThinkboxAWSPortalAdminPolicy": { "arn": "arn:aws:iam::aws:policy/AWSThinkboxAWSPortalAdminPolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2020-05-27T19:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v2": { "createdDate": "2020-08-08T03:39:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v6": { "createdDate": "2023-04-18T18:24:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3::*:logs-for-aws-portal-cache*" ] }, { "Effect": "Allow", "Action": [ "s3:PutBucketOwnershipControls" ], "Resource": [ "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v4": { "createdDate": "2020-08-20T17:16:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v5": { "createdDate": "2023-03-23T20:12:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v3": { "createdDate": "2020-08-18T21:01:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*" ] }, { "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v7": { "createdDate": "2020-05-27T19:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSThinkboxAWSPortal1", "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal2", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Sid": "AWSThinkboxAWSPortal3", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Sid": "AWSThinkboxAWSPortal4", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Sid": "AWSThinkboxAWSPortal5", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Sid": "AWSThinkboxAWSPortal6", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal7", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal8", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Sid": "AWSThinkboxAWSPortal9", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ] }, { "Sid": "AWSThinkboxAWSPortal10", "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal11", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal12", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal13", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Sid": "AWSThinkboxAWSPortal14", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal15", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal16", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal17", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3::*:logs-for-aws-portal-cache*" ] }, { "Sid": "AWSThinkboxAWSPortal18", "Effect": "Allow", "Action": [ "s3:PutBucketOwnershipControls" ], "Resource": [ "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal19", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal20", "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Sid": "AWSThinkboxAWSPortal21", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Sid": "AWSThinkboxAWSPortal22", "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal23", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Sid": "AWSThinkboxAWSPortal24", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal25", "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal26", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Sid": "AWSThinkboxAWSPortal27", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v8": { "createdDate": "2020-05-27T19:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSThinkboxAWSPortal1", "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal2", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Sid": "AWSThinkboxAWSPortal3", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Sid": "AWSThinkboxAWSPortal4", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Sid": "AWSThinkboxAWSPortal5", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*" } } }, { "Sid": "AWSThinkboxAWSPortal6", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal7", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:PlacementGroup": "*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal8", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Sid": "AWSThinkboxAWSPortal9", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ] }, { "Sid": "AWSThinkboxAWSPortal10", "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal11", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal12", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal13", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Sid": "AWSThinkboxAWSPortal14", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal15", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal16", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal17", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3::*:logs-for-aws-portal-cache*" ] }, { "Sid": "AWSThinkboxAWSPortal18", "Effect": "Allow", "Action": [ "s3:PutBucketOwnershipControls" ], "Resource": [ "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal19", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal20", "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Sid": "AWSThinkboxAWSPortal21", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Sid": "AWSThinkboxAWSPortal22", "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal23", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Sid": "AWSThinkboxAWSPortal24", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal25", "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal26", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Sid": "AWSThinkboxAWSPortal27", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } }, "v9": { "createdDate": "2020-05-27T19:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSThinkboxAWSPortal1", "Effect": "Allow", "Action": [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal2", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Sid": "AWSThinkboxAWSPortal3", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "ArnLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Sid": "AWSThinkboxAWSPortal4", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder" } } }, { "Sid": "AWSThinkboxAWSPortal5", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/aws:ec2spot:fleet-request-id": false } } }, { "Sid": "AWSThinkboxAWSPortal6", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:PlacementGroup": "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal7", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "ArnLike": { "ec2:PlacementGroup": "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*" } } }, { "Sid": "AWSThinkboxAWSPortal8", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringLike": { "ec2:CreateAction": "RunInstances" } } }, { "Sid": "AWSThinkboxAWSPortal9", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ] }, { "Sid": "AWSThinkboxAWSPortal10", "Effect": "Allow", "Action": [ "iam:GetUser" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal11", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal12", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Sid": "AWSThinkboxAWSPortal13", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Sid": "AWSThinkboxAWSPortal14", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal15", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal16", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource": [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal17", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3::*:logs-for-aws-portal-cache*" ] }, { "Sid": "AWSThinkboxAWSPortal18", "Effect": "Allow", "Action": [ "s3:PutBucketOwnershipControls" ], "Resource": [ "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid": "AWSThinkboxAWSPortal19", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal20", "Effect": "Allow", "Action": [ "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Sid": "AWSThinkboxAWSPortal21", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Sid": "AWSThinkboxAWSPortal22", "Effect": "Allow", "Action": [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal23", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Sid": "AWSThinkboxAWSPortal24", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource": "*" }, { "Sid": "AWSThinkboxAWSPortal25", "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Sid": "AWSThinkboxAWSPortal26", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": [ "rcs-tls-pw*" ] } } }, { "Sid": "AWSThinkboxAWSPortal27", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] } } }, "createdDate": "2020-05-27T19:41:02.000Z", "lastUpdatedDate": "2024-11-12T19:22:36.000Z" }, "AWSBackupServiceLinkedRolePolicyForBackup": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackup", "latestVersionId": "v18", "versionsCount": 18, "versions": { "v1": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2021-04-12T18:11:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*", "Effect": "Allow" } ] } }, "v4": { "createdDate": "2021-07-05T23:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" } ] } }, "v2": { "createdDate": "2020-11-10T18:37:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2021-10-20T18:16:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" } ] } }, "v6": { "createdDate": "2021-11-23T22:00:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "ListTagsForDynamoDBTable", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource" ], "Resource": "arn:aws:dynamodb:*:*:table/*" } ] } }, "v7": { "createdDate": "2022-01-14T19:17:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Effect": "Allow", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" } ] } }, "v9": { "createdDate": "2022-05-05T17:45:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" } ] } }, "v8": { "createdDate": "2022-02-18T17:38:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" } ] } }, "v10": { "createdDate": "2022-05-17T17:21:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" } ] } }, "v11": { "createdDate": "2022-07-28T17:29:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sysops-sap:GetOperation" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2022-11-10T22:51:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sysops-sap:GetOperation", "ssm-sap:GetOperation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*/table/*", "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] } ] } }, "v13": { "createdDate": "2023-04-24T21:22:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] } ] } }, "v14": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EFSResourcePermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Sid": "DescribePermissions", "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Sid": "SnapshotCopyTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Sid": "EC2CreateBackupTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "EC2RDSDescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:ModifySnapshotTier", "ec2:DescribeSnapshotTierStatus" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "RDSInstanceAndSnashotPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstanceAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSGrantPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamoDBDeletePermissions", "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EventBridgePermissions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "RedshiftDescribePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] } ] } }, "v15": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EFSResourcePermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Sid": "DescribePermissions", "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Sid": "SnapshotCopyTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Sid": "EC2CreateBackupTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "EC2RDSDescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeSnapshotTierStatus", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:ModifySnapshotTier" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "RDSInstanceAndSnashotPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstanceAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSGrantPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamoDBDeletePermissions", "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EventBridgePermissions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "RedshiftDescribePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] } ] } }, "v16": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EFSResourcePermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Sid": "DescribePermissions", "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Sid": "SnapshotCopyTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Sid": "EC2CreateBackupTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "EC2RDSDescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeSnapshotTierStatus", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:ModifySnapshotTier" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "RDSInstanceAndSnashotPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstanceAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSGrantPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamoDBDeletePermissions", "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EventBridgePermissions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "RedshiftDescribePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } }, "v17": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EFSResourcePermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Sid": "DescribePermissions", "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Sid": "SnapshotCopyTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Sid": "EC2CreateBackupTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "EC2RDSDescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeSnapshotTierStatus", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:ModifySnapshotTier" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "RDSInstanceAndSnashotPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstanceAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Sid": "RDSSnapshotTenantDatabasePermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource" ], "Resource": [ "arn:aws:rds:*:*:snapshot-tenant-database:awsbackup:*" ] }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSGrantPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamoDBDeletePermissions", "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EventBridgePermissions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "RedshiftDescribePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } }, "v18": { "createdDate": "2020-06-02T23:08:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EFSResourcePermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "StringLike": { "aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled" } } }, { "Sid": "DescribePermissions", "Effect": "Allow", "Action": [ "tag:GetResources", "elasticfilesystem:DescribeFileSystems", "dynamodb:ListTables", "storagegateway:ListVolumes", "ec2:DescribeVolumes", "ec2:DescribeInstances", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "s3:ListAllMyBuckets", "s3:GetBucketTagging" ], "Resource": "*" }, { "Sid": "SnapshotCopyTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Sid": "EC2CreateBackupTagPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSBackupManagedResource" ] } } }, { "Sid": "EC2CreateTagsPermissions", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "EC2RDSDescribePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeSnapshotTierStatus", "ec2:DescribeImages", "rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots" ], "Resource": "*" }, { "Sid": "EBSCopyPermissions", "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "EC2CopyPermissions", "Effect": "Allow", "Action": "ec2:CopyImage", "Resource": "*" }, { "Sid": "EC2ModifyPermissions", "Effect": "Allow", "Action": [ "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:ModifySnapshotTier" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSBackupManagedResource": "false" } } }, { "Sid": "RDSInstanceAndSnashotPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstanceAutomatedBackup" ], "Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*" }, { "Sid": "RDSClusterPermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" }, { "Sid": "RDSSnapshotTenantDatabasePermissions", "Effect": "Allow", "Action": [ "rds:AddTagsToResource" ], "Resource": [ "arn:aws:rds:*:*:snapshot-tenant-database:awsbackup:*" ] }, { "Sid": "KMSDescribePermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "KMSGrantPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:ReEncryptFrom", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "KMSCreateGrantPermissions", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "rds.*.amazonaws.com", "fsx.*.amazonaws.com" ] } } }, { "Sid": "FsxPermissions", "Effect": "Allow", "Action": [ "fsx:CopyBackup", "fsx:TagResource", "fsx:DescribeBackups", "fsx:DeleteBackup" ], "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Sid": "DynamoDBDeletePermissions", "Effect": "Allow", "Action": "dynamodb:DeleteBackup", "Resource": "arn:aws:dynamodb:*:*:table/*/backup/*" }, { "Sid": "BackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListVirtualMachines" ], "Resource": "*" }, { "Sid": "ListTagsForBackupGateway", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "DynamoDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTagsOfResource", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Sid": "StorageGatewayPermissions", "Effect": "Allow", "Action": [ "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Sid": "EventBridgePermissions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "SSMSAPPermissions", "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:UpdateHANABackupSettings" ], "Resource": "*" }, { "Sid": "TimestreamResourcePermissions", "Effect": "Allow", "Action": [ "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:GetAwsBackupStatus", "timestream:GetAwsRestoreStatus" ], "Resource": [ "arn:aws:timestream:*:*:database/*" ] }, { "Sid": "TimestreamPermissions", "Effect": "Allow", "Action": [ "timestream:DescribeEndpoints" ], "Resource": "*" }, { "Sid": "RedshiftDescribePermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusterSnapshots", "redshift:DescribeTags" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftClusterSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift:DeleteClusterSnapshot" ], "Resource": [ "arn:aws:redshift:*:*:snapshot:*/*" ] }, { "Sid": "RedshiftClusterPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "RedshiftServerlessGetPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetSnapshot", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift-serverless:*:*:snapshot/*" ] }, { "Sid": "RedshiftServerlessDeleteSnapshotPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:DeleteSnapshot" ], "Resource": [ "arn:aws:redshift-serverless:*:*:snapshot/*" ], "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Sid": "RedshiftServerlessListPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups" ], "Resource": [ "*" ] }, { "Sid": "CloudformationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/*" ] }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2020-06-02T23:08:40.000Z", "lastUpdatedDate": "2025-03-21T23:22:06.000Z" }, "AmazonAppFlowReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAppFlowReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-02T23:26:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeConnectors", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlows", "appflow:DescribeFlowExecution", "appflow:DescribeConnectorFields", "appflow:ListConnectorFields", "appflow:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-02-28T20:42:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeConnector", "appflow:DescribeConnectors", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlows", "appflow:DescribeFlowExecution", "appflow:DescribeConnectorFields", "appflow:ListConnectors", "appflow:ListConnectorFields", "appflow:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-02T23:26:51.000Z", "lastUpdatedDate": "2022-02-28T20:42:58.000Z" }, "AmazonAppFlowFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAppFlowFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-06-02T23:30:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "appflow:*", "Resource": "*" }, { "Sid": "ListRolesForRedshift", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "KMSListAccess", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "KMSGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSListGrantAccess", "Effect": "Allow", "Action": [ "kms:ListGrants" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" } } }, { "Sid": "S3ReadAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Sid": "S3PutBucketPolicyAccess", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::appflow-*" } ] } }, "v2": { "createdDate": "2020-12-07T22:49:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "appflow:*", "Resource": "*" }, { "Sid": "ListRolesForRedshift", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "KMSListAccess", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "KMSGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSListGrantAccess", "Effect": "Allow", "Action": [ "kms:ListGrants" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" } } }, { "Sid": "S3ReadAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Sid": "S3PutBucketPolicyAccess", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::appflow-*" }, { "Sid": "SecretsManagerCreateSecretAccess", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Sid": "SecretsManagerPutResourcePolicyAccess", "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } } ] } }, "v3": { "createdDate": "2022-02-28T23:11:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "appflow:*", "Resource": "*" }, { "Sid": "ListRolesForRedshift", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "KMSListAccess", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KMSGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "KMSListGrantAccess", "Effect": "Allow", "Action": [ "kms:ListGrants" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" } } }, { "Sid": "S3ReadAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Sid": "S3PutBucketPolicyAccess", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::appflow-*" }, { "Sid": "SecretsManagerCreateSecretAccess", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Sid": "SecretsManagerPutResourcePolicyAccess", "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } }, { "Sid": "LambdaListFunctions", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-02T23:30:14.000Z", "lastUpdatedDate": "2022-02-28T23:11:23.000Z" }, "AlexaForBusinessLifesizeDelegatedAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AlexaForBusinessLifesizeDelegatedAccessPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-04T19:46:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:DisassociateDeviceFromRoom", "a4b:DeleteDevice", "a4b:UpdateDevice", "a4b:GetDevice" ], "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A2IWO7UEGWV4TL" ] }, { "Effect": "Allow", "Action": [ "a4b:RegisterAVSDevice" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "a4b:amazonId": [ "A2IWO7UEGWV4TL" ] } } }, { "Effect": "Allow", "Action": [ "a4b:SearchDevices" ], "Resource": [ "*" ], "Condition": { "ForAllValues:StringLike": { "a4b:filters_deviceType": [ "*A2IWO7UEGWV4TL" ] }, "Null": { "a4b:filters_deviceType": "false" } } }, { "Effect": "Allow", "Action": [ "a4b:AssociateDeviceWithRoom" ], "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A2IWO7UEGWV4TL", "arn:aws:a4b:us-east-1:*:room/*" ] }, { "Effect": "Allow", "Action": [ "a4b:GetRoom", "a4b:GetAddressBook", "a4b:SearchRooms", "a4b:CreateContact", "a4b:CreateRoom", "a4b:UpdateContact", "a4b:ListConferenceProviders", "a4b:DeleteRoom", "a4b:CreateAddressBook", "a4b:DisassociateContactFromAddressBook", "a4b:CreateConferenceProvider", "a4b:PutConferencePreference", "a4b:DeleteAddressBook", "a4b:AssociateContactWithAddressBook", "a4b:DeleteContact", "a4b:SearchProfiles", "a4b:UpdateProfile", "a4b:GetContact" ], "Resource": "*" }, { "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": "arn:aws:kms:::key/*" } ] } }, "v2": { "createdDate": "2020-06-12T20:31:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:DisassociateDeviceFromRoom", "a4b:DeleteDevice", "a4b:UpdateDevice", "a4b:GetDevice" ], "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A2IWO7UEGWV4TL" ] }, { "Effect": "Allow", "Action": [ "a4b:RegisterAVSDevice" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "a4b:amazonId": [ "A2IWO7UEGWV4TL" ] } } }, { "Effect": "Allow", "Action": [ "a4b:SearchDevices" ], "Resource": [ "*" ], "Condition": { "ForAllValues:StringLike": { "a4b:filters_deviceType": [ "*A2IWO7UEGWV4TL" ] }, "Null": { "a4b:filters_deviceType": "false" } } }, { "Effect": "Allow", "Action": [ "a4b:AssociateDeviceWithRoom" ], "Resource": [ "arn:aws:a4b:us-east-1:*:device/*/*:A2IWO7UEGWV4TL", "arn:aws:a4b:us-east-1:*:room/*" ] }, { "Effect": "Allow", "Action": [ "a4b:GetRoom", "a4b:GetAddressBook", "a4b:SearchRooms", "a4b:CreateContact", "a4b:CreateRoom", "a4b:UpdateContact", "a4b:ListConferenceProviders", "a4b:DeleteRoom", "a4b:CreateAddressBook", "a4b:DisassociateContactFromAddressBook", "a4b:CreateConferenceProvider", "a4b:PutConferencePreference", "a4b:DeleteAddressBook", "a4b:AssociateContactWithAddressBook", "a4b:DeleteContact", "a4b:SearchProfiles", "a4b:UpdateProfile", "a4b:GetContact" ], "Resource": "*" }, { "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": "arn:aws:kms:*:*:key/*" } ] } } }, "createdDate": "2020-06-04T19:46:56.000Z", "lastUpdatedDate": "2020-06-12T20:31:59.000Z" }, "ElementalActivationsFullAccess": { "arn": "arn:aws:iam::aws:policy/ElementalActivationsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-04T21:00:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-activations:*" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-04T21:00:13.000Z", "lastUpdatedDate": "2020-06-04T21:00:13.000Z" }, "AWSElasticBeanstalkRoleWorkerTier": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleWorkerTier", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-05T21:43:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSQS", "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:CreateQueue" ], "Resource": "arn:aws:sqs:*:*:awseb-e-*" }, { "Sid": "AllowDDB", "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:TagResource", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/awseb-e-*" } ] } } }, "createdDate": "2020-06-05T21:43:37.000Z", "lastUpdatedDate": "2020-06-05T21:43:37.000Z" }, "AWSElasticBeanstalkRoleSNS": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleSNS", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-05T21:46:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowBeanstalkManageSNS", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes", "sns:DeleteTopic" ], "Resource": [ "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" ] }, { "Sid": "AllowSNSPublish", "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe", "sns:Publish" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-05T21:46:22.000Z", "lastUpdatedDate": "2020-06-05T21:46:22.000Z" }, "AWSElasticBeanstalkRoleRDS": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleRDS", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-05T21:46:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowRDS", "Effect": "Allow", "Action": [ "rds:CreateDBSecurityGroup", "rds:DeleteDBSecurityGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:ModifyDBInstance", "rds:DeleteDBInstance" ], "Resource": [ "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:db:*" ] } ] } } }, "createdDate": "2020-06-05T21:46:55.000Z", "lastUpdatedDate": "2020-06-05T21:46:55.000Z" }, "AWSElasticBeanstalkRoleECS": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleECS", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-05T21:47:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowECS", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2023-03-23T22:43:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowECS", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeRegisterTaskDefinition" ], "Resource": [ "*" ] }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] } } }, "createdDate": "2020-06-05T21:47:27.000Z", "lastUpdatedDate": "2023-03-23T22:43:56.000Z" }, "AWSElasticBeanstalkRoleCore": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleCore", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2020-09-09T20:31:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TerminateInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/awseb-e-*" } } }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress", "ec2:AllocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress", "ec2:CreateTags", "ec2:DeleteTags", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroup*", "ec2:RevokeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:DeleteLaunchTemplate*" ], "Resource": "*" }, { "Sid": "LTRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:*LoadBalancer*", "autoscaling:*AutoScalingGroup", "autoscaling:*LaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:*Tags" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*" ] }, { "Sid": "ASGPolicy", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy" ], "Resource": [ "*" ] }, { "Sid": "EBSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "elasticbeanstalk.amazonaws.com" } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*/*", "arn:aws:s3:::elasticbeanstalk-env-resources-*/*" ] }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:UpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CancelUpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/awseb-e-*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:awseb-*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:Create*", "elasticloadbalancing:Delete*", "elasticloadbalancing:Modify*", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:*Tags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/app/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/net/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*" ] }, { "Sid": "ListAPIs", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:Describe*", "logs:Describe*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticloadbalancing:Describe*", "rds:Describe*", "sns:List*", "iam:List*", "acm:Describe*", "acm:List*" ], "Resource": "*" }, { "Sid": "AllowPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } } ] } }, "v1": { "createdDate": "2020-06-05T21:48:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TerminateInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/awseb-e-*" } } }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress", "ec2:AllocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress", "ec2:CreateTags", "ec2:DeleteTags", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroup*", "ec2:RevokeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:DeleteLaunchTemplate*" ], "Resource": "*" }, { "Sid": "LTRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:*LoadBalancer*", "autoscaling:*AutoScalingGroup", "autoscaling:*LaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:*Tags" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*" ] }, { "Sid": "ASGPolicy", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy" ], "Resource": [ "*" ] }, { "Sid": "EBSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "elasticbeanstalk.amazonaws.com" } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*/*", "arn:aws:s3:::elasticbeanstalk-env-resources-*/*" ] }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:UpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CancelUpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/awseb-e-*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:awseb-*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:Create*", "elasticloadbalancing:Delete*", "elasticloadbalancing:Modify*", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:*Tags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/app/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/net/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*" ] }, { "Sid": "ListAPIs", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:Describe*", "logs:Describe*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticloadbalancing:Describe*", "rds:Describe*", "sns:List*", "iam:List*", "acm:Describe*", "acm:List*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-06-05T21:48:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TerminateInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/awseb-e-*" } } }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:ReleaseAddress", "ec2:AllocateAddress", "ec2:DisassociateAddress", "ec2:AssociateAddress", "ec2:CreateTags", "ec2:DeleteTags", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroup*", "ec2:RevokeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:DeleteLaunchTemplate*" ], "Resource": "*" }, { "Sid": "LTRunInstances", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "ASG", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:*LoadBalancer*", "autoscaling:*AutoScalingGroup", "autoscaling:*LaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:PutNotificationConfiguration", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses", "autoscaling:*Tags" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*" ] }, { "Sid": "ASGPolicy", "Effect": "Allow", "Action": [ "autoscaling:DeletePolicy" ], "Resource": [ "*" ] }, { "Sid": "EBSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": "elasticbeanstalk.amazonaws.com" } } }, { "Sid": "S3Obj", "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-*/*", "arn:aws:s3:::elasticbeanstalk-env-resources-*/*" ] }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "CFN", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:UpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CancelUpdateStack", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/awseb-e-*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:awseb-*" }, { "Sid": "ELB", "Effect": "Allow", "Action": [ "elasticloadbalancing:Create*", "elasticloadbalancing:Delete*", "elasticloadbalancing:Modify*", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeRegisterTargets", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:*Tags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/app/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/net/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*" ] }, { "Sid": "ListAPIs", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:Describe*", "logs:Describe*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticloadbalancing:Describe*", "rds:Describe*", "sns:List*", "iam:List*", "acm:Describe*", "acm:List*" ], "Resource": "*" }, { "Sid": "AllowPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk-*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-06-05T21:48:24.000Z", "lastUpdatedDate": "2024-04-30T00:01:53.000Z" }, "AWSElasticBeanstalkRoleCWL": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkRoleCWL", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-05T21:49:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCWL", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" } ] } } }, "createdDate": "2020-06-05T21:49:06.000Z", "lastUpdatedDate": "2020-06-05T21:49:06.000Z" }, "AWSCodeArtifactAdminAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeArtifactAdminAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-16T23:53:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeartifact:*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "sts:GetServiceBearerToken", "Resource": "*", "Condition": { "StringEquals": { "sts:AWSServiceName": "codeartifact.amazonaws.com" } } } ] } } }, "createdDate": "2020-06-16T23:53:23.000Z", "lastUpdatedDate": "2020-06-16T23:53:23.000Z" }, "AWSBackupOrganizationAdminAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupOrganizationAdminAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-06-24T16:23:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DisableAWSServiceAccess", "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "organizations:ServicePrincipal": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:AttachPolicy", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:DetachPolicy", "organizations:DisablePolicyType", "organizations:DescribePolicy", "organizations:DescribeEffectivePolicy", "organizations:ListPolicies", "organizations:EnablePolicyType", "organizations:CreatePolicy", "organizations:UpdatePolicy", "organizations:DeletePolicy" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:PolicyType": [ "BACKUP_POLICY" ] } } }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListParents", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListOrganizationalUnitsForParent", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-11-24T22:09:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DisableAWSServiceAccess", "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:AttachPolicy", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:DetachPolicy", "organizations:DisablePolicyType", "organizations:DescribePolicy", "organizations:DescribeEffectivePolicy", "organizations:ListPolicies", "organizations:EnablePolicyType", "organizations:CreatePolicy", "organizations:UpdatePolicy", "organizations:DeletePolicy" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:PolicyType": [ "BACKUP_POLICY" ] } } }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListParents", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListOrganizationalUnitsForParent", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-18T18:26:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DisableAWSServiceAccess", "organizations:EnableAWSServiceAccess", "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "arn:aws:organizations::*:account/*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "backup.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:AttachPolicy", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:DetachPolicy", "organizations:DisablePolicyType", "organizations:DescribePolicy", "organizations:DescribeEffectivePolicy", "organizations:ListPolicies", "organizations:EnablePolicyType", "organizations:CreatePolicy", "organizations:UpdatePolicy", "organizations:DeletePolicy" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:PolicyType": [ "BACKUP_POLICY" ] } } }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListParents", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListOrganizationalUnitsForParent", "organizations:ListChildren", "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-24T16:23:14.000Z", "lastUpdatedDate": "2022-11-18T18:26:40.000Z" }, "AmazonMachineLearningRoleforRedshiftDataSourceV3": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonMachineLearningRoleforRedshiftDataSourceV3", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-24T18:00:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupIngress", "redshift:AuthorizeClusterSecurityGroupIngress", "redshift:CreateClusterSecurityGroup", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:ModifyCluster", "redshift:RevokeClusterSecurityGroupIngress" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::amazon-machine-learning*" } ] } } }, "createdDate": "2020-06-24T18:00:09.000Z", "lastUpdatedDate": "2020-06-24T18:00:09.000Z" }, "AmazonHoneycodeTeamAssociationReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeTeamAssociationReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-24T20:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:ListTeamAssociations" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:27:46.000Z", "lastUpdatedDate": "2020-06-24T20:27:46.000Z" }, "AmazonHoneycodeWorkbookReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeWorkbookReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-24T20:28:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:GetScreenData" ], "Resource": "*", "Effect": "Allow" } ] } }, "v2": { "createdDate": "2020-12-01T17:32:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:GetScreenData", "honeycode:DescribeTableDataImportJob", "honeycode:ListTableColumns", "honeycode:ListTableRows", "honeycode:ListTables", "honeycode:QueryTableRows" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:28:07.000Z", "lastUpdatedDate": "2020-12-01T17:32:49.000Z" }, "AmazonHoneycodeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-24T20:28:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:*" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:28:11.000Z", "lastUpdatedDate": "2020-06-24T20:28:11.000Z" }, "AmazonHoneycodeReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-24T20:28:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:List*", "honeycode:Get*" ], "Resource": "*", "Effect": "Allow" } ] } }, "v2": { "createdDate": "2020-12-01T17:27:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:List*", "honeycode:Get*", "honeycode:Describe*", "honeycode:Query*" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:28:16.000Z", "lastUpdatedDate": "2020-12-01T17:27:53.000Z" }, "AmazonHoneycodeTeamAssociationFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeTeamAssociationFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-24T20:28:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:ListTeamAssociations", "honeycode:ApproveTeamAssociation", "honeycode:RejectTeamAssociation" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:28:27.000Z", "lastUpdatedDate": "2020-06-24T20:28:27.000Z" }, "AmazonHoneycodeWorkbookFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHoneycodeWorkbookFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-06-24T20:28:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:GetScreenData", "honeycode:InvokeScreenAutomation" ], "Resource": "*", "Effect": "Allow" } ] } }, "v2": { "createdDate": "2020-12-01T17:30:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "honeycode:GetScreenData", "honeycode:InvokeScreenAutomation", "honeycode:BatchCreateTableRows", "honeycode:BatchDeleteTableRows", "honeycode:BatchUpdateTableRows", "honeycode:BatchUpsertTableRows", "honeycode:DescribeTableDataImportJob", "honeycode:ListTableColumns", "honeycode:ListTableRows", "honeycode:ListTables", "honeycode:QueryTableRows", "honeycode:StartTableDataImportJob" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-06-24T20:28:46.000Z", "lastUpdatedDate": "2020-12-01T17:30:06.000Z" }, "CertificateManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CertificateManagerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-25T17:56:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:GetCertificate" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-25T17:56:49.000Z", "lastUpdatedDate": "2020-06-25T17:56:49.000Z" }, "AWSCodeArtifactReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-25T21:23:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "codeartifact:Describe*", "codeartifact:Get*", "codeartifact:List*", "codeartifact:ReadFromRepository" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "sts:GetServiceBearerToken", "Resource": "*", "Condition": { "StringEquals": { "sts:AWSServiceName": "codeartifact.amazonaws.com" } } } ] } } }, "createdDate": "2020-06-25T21:23:52.000Z", "lastUpdatedDate": "2020-06-25T21:23:52.000Z" }, "AWSServiceRoleForCodeGuru-Profiler": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForCodeGuru-Profiler", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-26T22:04:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSNSPublishToSendNotifications", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-26T22:04:26.000Z", "lastUpdatedDate": "2020-06-26T22:04:26.000Z" }, "AmazonCognitoIdpServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonCognitoIdpServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-06-26T22:30:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-idp:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2020-06-26T22:30:20.000Z", "lastUpdatedDate": "2020-06-26T22:30:20.000Z" }, "AWSElementalMediaLiveReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaLiveReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-07-08T16:38:07.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "medialive:List*", "medialive:Describe*" ], "Resource": "*" } } }, "v2": { "createdDate": "2020-07-08T16:38:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSElementalMediaLiveReadOnly", "Effect": "Allow", "Action": [ "medialive:Get*", "medialive:List*", "medialive:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2020-07-08T16:38:07.000Z", "lastUpdatedDate": "2024-07-22T17:08:46.000Z" }, "AWSElementalMediaLiveFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaLiveFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-07-08T17:07:14.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "medialive:*", "Resource": "*" } } } }, "createdDate": "2020-07-08T17:07:14.000Z", "lastUpdatedDate": "2020-07-08T17:07:14.000Z" }, "AmazonSageMakerGroundTruthExecution": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerGroundTruthExecution", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-07-09T19:30:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CustomLabelingJobs", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*GtRecipe*", "arn:aws:lambda:*:*:function:*LabelingFunction*", "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*GroundTruth*", "arn:aws:s3:::*Groundtruth*", "arn:aws:s3:::*groundtruth*", "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Sid": "StreamingQueue", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:SendMessageBatch", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:*GroundTruth*" }, { "Sid": "StreamingTopicSubscribe", "Effect": "Allow", "Action": "sns:Subscribe", "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ], "Condition": { "StringEquals": { "sns:Protocol": "sqs" }, "StringLike": { "sns:Endpoint": "arn:aws:sqs:*:*:*GroundTruth*" } } }, { "Sid": "StreamingTopic", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "StreamingTopicUnsubscribe", "Effect": "Allow", "Action": [ "sns:Unsubscribe" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-04-11T21:22:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CustomLabelingJobs", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*GtRecipe*", "arn:aws:lambda:*:*:function:*LabelingFunction*", "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*GroundTruth*", "arn:aws:s3:::*Groundtruth*", "arn:aws:s3:::*groundtruth*", "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Sid": "StreamingQueue", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:*GroundTruth*" }, { "Sid": "StreamingTopicSubscribe", "Effect": "Allow", "Action": "sns:Subscribe", "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ], "Condition": { "StringEquals": { "sns:Protocol": "sqs" }, "StringLike": { "sns:Endpoint": "arn:aws:sqs:*:*:*GroundTruth*" } } }, { "Sid": "StreamingTopic", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "StreamingTopicUnsubscribe", "Effect": "Allow", "Action": [ "sns:Unsubscribe" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-04-29T20:49:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CustomLabelingJobs", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*GtRecipe*", "arn:aws:lambda:*:*:function:*LabelingFunction*", "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*GroundTruth*", "arn:aws:s3:::*Groundtruth*", "arn:aws:s3:::*groundtruth*", "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "*" }, { "Sid": "StreamingQueue", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:*GroundTruth*" }, { "Sid": "StreamingTopicSubscribe", "Effect": "Allow", "Action": "sns:Subscribe", "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ], "Condition": { "StringEquals": { "sns:Protocol": "sqs" }, "StringLike": { "sns:Endpoint": "arn:aws:sqs:*:*:*GroundTruth*" } } }, { "Sid": "StreamingTopic", "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*GroundTruth*", "arn:aws:sns:*:*:*Groundtruth*", "arn:aws:sns:*:*:*groundTruth*", "arn:aws:sns:*:*:*groundtruth*", "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sageMaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "StreamingTopicUnsubscribe", "Effect": "Allow", "Action": [ "sns:Unsubscribe" ], "Resource": "*" }, { "Sid": "WorkforceVPC", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ec2:VpceServiceName": [ "*sagemaker-task-resources*", "aws.sagemaker*labeling*" ] } } } ] } } }, "createdDate": "2020-07-09T19:30:20.000Z", "lastUpdatedDate": "2022-04-29T20:49:54.000Z" }, "ServerMigrationServiceRoleForInstanceValidation": { "arn": "arn:aws:iam::aws:policy/service-role/ServerMigrationServiceRoleForInstanceValidation", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-07-20T22:25:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::sms-app-*/*" }, { "Effect": "Allow", "Action": "sms:NotifyAppValidationOutput", "Resource": "*" } ] } } }, "createdDate": "2020-07-20T22:25:07.000Z", "lastUpdatedDate": "2020-07-20T22:25:07.000Z" }, "AWSCodePipeline_ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodePipeline_ReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-03T22:25:17.000Z", "document": { "Statement": [ { "Action": [ "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:GetPipelineExecution", "codepipeline:ListPipelineExecutions", "codepipeline:ListActionExecutions", "codepipeline:ListActionTypes", "codepipeline:ListPipelines", "codepipeline:ListTagsForResource", "s3:ListAllMyBuckets", "codestar-notifications:ListNotificationRules", "codestar-notifications:ListEventTypes", "codestar-notifications:ListTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetBucketPolicy" ], "Effect": "Allow", "Resource": "arn:aws:s3::*:codepipeline-*" }, { "Sid": "CodeStarNotificationsReadOnlyAccess", "Effect": "Allow", "Action": [ "codestar-notifications:DescribeNotificationRule" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*" } } } ], "Version": "2012-10-17" } } }, "createdDate": "2020-08-03T22:25:17.000Z", "lastUpdatedDate": "2020-08-03T22:25:17.000Z" }, "AWSCodePipeline_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-08-03T22:38:28.000Z", "document": { "Statement": [ { "Action": [ "codepipeline:*", "cloudformation:DescribeStacks", "cloudformation:ListChangeSets", "cloudtrail:DescribeTrails", "codebuild:BatchGetProjects", "codebuild:CreateProject", "codebuild:ListCuratedEnvironmentImages", "codebuild:ListProjects", "codecommit:ListBranches", "codecommit:GetReferences", "codecommit:ListRepositories", "codedeploy:BatchGetDeploymentGroups", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:ListClusters", "ecs:ListServices", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "iam:ListRoles", "iam:GetRole", "lambda:ListFunctions", "events:ListRules", "events:ListTargetsByRule", "events:DescribeRule", "opsworks:DescribeApps", "opsworks:DescribeLayers", "opsworks:DescribeStacks", "s3:ListAllMyBuckets", "sns:ListTopics", "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes", "states:ListStateMachines" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetObjectVersion", "s3:CreateBucket", "s3:PutBucketPolicy" ], "Effect": "Allow", "Resource": "arn:aws:s3::*:codepipeline-*" }, { "Action": [ "cloudtrail:PutEventSelectors", "cloudtrail:CreateTrail", "cloudtrail:GetEventSelectors", "cloudtrail:StartLogging" ], "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/codepipeline-source-trail" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/cwe-role-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "codepipeline.amazonaws.com" ] } } }, { "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:DisableRule", "events:RemoveTargets" ], "Effect": "Allow", "Resource": [ "arn:aws:events:*:*:rule/codepipeline-*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*" } } }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2023-06-21T22:46:59.000Z", "document": { "Statement": [ { "Action": [ "codepipeline:*", "cloudformation:DescribeStacks", "cloudformation:ListChangeSets", "cloudtrail:DescribeTrails", "codebuild:BatchGetProjects", "codebuild:CreateProject", "codebuild:ListCuratedEnvironmentImages", "codebuild:ListProjects", "codecommit:ListBranches", "codecommit:GetReferences", "codecommit:ListRepositories", "codedeploy:BatchGetDeploymentGroups", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:ListClusters", "ecs:ListServices", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "iam:ListRoles", "iam:GetRole", "lambda:ListFunctions", "events:ListRules", "events:ListTargetsByRule", "events:DescribeRule", "opsworks:DescribeApps", "opsworks:DescribeLayers", "opsworks:DescribeStacks", "s3:ListAllMyBuckets", "sns:ListTopics", "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes", "states:ListStateMachines" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetObjectVersion", "s3:CreateBucket", "s3:PutBucketPolicy" ], "Effect": "Allow", "Resource": "arn:aws:s3::*:codepipeline-*" }, { "Action": [ "cloudtrail:PutEventSelectors", "cloudtrail:CreateTrail", "cloudtrail:GetEventSelectors", "cloudtrail:StartLogging" ], "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/codepipeline-source-trail" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/cwe-role-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com" ] } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "codepipeline.amazonaws.com" ] } } }, { "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:DisableRule", "events:RemoveTargets" ], "Effect": "Allow", "Resource": [ "arn:aws:events:*:*:rule/codepipeline-*" ] }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*" } } }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2020-08-03T22:38:28.000Z", "document": { "Statement": [ { "Action": [ "codepipeline:*", "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudformation:ListChangeSets", "cloudtrail:DescribeTrails", "codebuild:BatchGetProjects", "codebuild:CreateProject", "codebuild:ListCuratedEnvironmentImages", "codebuild:ListProjects", "codecommit:ListBranches", "codecommit:GetReferences", "codecommit:ListRepositories", "codedeploy:BatchGetDeploymentGroups", "codedeploy:ListApplications", "codedeploy:ListDeploymentGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:ListClusters", "ecs:ListServices", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "iam:ListRoles", "iam:GetRole", "lambda:ListFunctions", "events:ListRules", "events:ListTargetsByRule", "events:DescribeRule", "opsworks:DescribeApps", "opsworks:DescribeLayers", "opsworks:DescribeStacks", "s3:ListAllMyBuckets", "sns:ListTopics", "codestar-notifications:ListNotificationRules", "codestar-notifications:ListTargets", "codestar-notifications:ListTagsforResource", "codestar-notifications:ListEventTypes", "states:ListStateMachines" ], "Effect": "Allow", "Resource": "*", "Sid": "CodePipelineAuthoringAccess" }, { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetObjectVersion", "s3:CreateBucket", "s3:PutBucketPolicy" ], "Effect": "Allow", "Resource": "arn:aws:s3::*:codepipeline-*", "Sid": "CodePipelineArtifactsReadWriteAccess" }, { "Action": [ "cloudtrail:PutEventSelectors", "cloudtrail:CreateTrail", "cloudtrail:GetEventSelectors", "cloudtrail:StartLogging" ], "Effect": "Allow", "Resource": "arn:aws:cloudtrail:*:*:trail/codepipeline-source-trail", "Sid": "CodePipelineSourceTrailReadWriteAccess" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/service-role/cwe-role-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com" ] } }, "Sid": "EventsIAMPassRole" }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "codepipeline.amazonaws.com" ] } }, "Sid": "CodePipelineIAMPassRole" }, { "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:DisableRule", "events:RemoveTargets" ], "Effect": "Allow", "Resource": [ "arn:aws:events:*:*:rule/codepipeline-*" ], "Sid": "CodePipelineEventsReadWriteAccess" }, { "Sid": "CodeStarNotificationsReadWriteAccess", "Effect": "Allow", "Action": [ "codestar-notifications:CreateNotificationRule", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:UpdateNotificationRule", "codestar-notifications:DeleteNotificationRule", "codestar-notifications:Subscribe", "codestar-notifications:Unsubscribe" ], "Resource": "*", "Condition": { "StringLike": { "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*" } } }, { "Sid": "CodeStarNotificationsSNSTopicCreateAccess", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": "arn:aws:sns:*:*:codestar-notifications*" }, { "Sid": "CodeStarNotificationsChatbotAccess", "Effect": "Allow", "Action": [ "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations" ], "Resource": "*" } ], "Version": "2012-10-17" } } }, "createdDate": "2020-08-03T22:38:28.000Z", "lastUpdatedDate": "2024-03-14T17:06:23.000Z" }, "AmazonBraketServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonBraketServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-08-04T17:12:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket/*" } ] } }, "v2": { "createdDate": "2020-08-06T20:10:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket:*" } ] } } }, "createdDate": "2020-08-04T17:12:23.000Z", "lastUpdatedDate": "2020-08-06T20:10:42.000Z" }, "AWSLakeFormationCrossAccountManager": { "arn": "arn:aws:iam::aws:policy/AWSLakeFormationCrossAccountManager", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2020-08-04T20:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-10-07T22:39:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEquals": { "ram:RequestedResourceType": "glue:Table" } } }, { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEquals": { "ram:RequestedResourceType": "glue:Database" } } }, { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEquals": { "ram:RequestedResourceType": "glue:Catalog" } } }, { "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "LakeFormation" } } }, { "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-07T23:11:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-05-20T22:19:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-08-04T20:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceSharePermission" ], "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": [ "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" ] } } }, { "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-08-04T20:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCreateResourceShare", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Sid": "AllowManageResourceShare", "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Sid": "AllowManageResourceSharePermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceSharePermission" ], "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": [ "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" ] } } }, { "Sid": "AllowXAcctManagerPermissions", "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Sid": "AllowOrganizationsPermissions", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2020-08-04T20:59:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCreateResourceShare", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] } } }, { "Sid": "AllowManageResourceShare", "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Sid": "AllowManageResourceSharePermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceSharePermission" ], "Resource": "*", "Condition": { "ArnLike": { "ram:PermissionArn": [ "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" ] } } }, { "Sid": "AllowXAcctManagerPermissions", "Effect": "Allow", "Action": [ "glue:PutResourcePolicy", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "ram:Get*", "ram:List*" ], "Resource": "*" }, { "Sid": "AllowOrganizationsPermissions", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-04T20:59:46.000Z", "lastUpdatedDate": "2025-02-25T00:37:06.000Z" }, "AmazonLaunchWizard_Fullaccess": { "arn": "arn:aws:iam::aws:policy/AmazonLaunchWizard_Fullaccess", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2020-08-06T17:47:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBuckets", "s3:ListObjects", "s3:ListObjectsV2" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:::stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] } ] } }, "v3": { "createdDate": "2020-10-09T22:27:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListObjects", "s3:ListObjectsV2", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:::stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] } ] } }, "v2": { "createdDate": "2020-09-01T20:02:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListObjects", "s3:ListObjectsV2" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:::log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:::stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] } ] } }, "v5": { "createdDate": "2020-11-14T02:27:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" } ] } }, "v4": { "createdDate": "2020-11-11T20:26:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] } ] } }, "v7": { "createdDate": "2020-12-12T21:51:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-02-12T17:06:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" } ] } }, "v6": { "createdDate": "2020-12-04T16:01:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-04-08T19:03:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" } ] } }, "v10": { "createdDate": "2021-05-24T23:04:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2021-08-25T17:24:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } } ] } }, "v12": { "createdDate": "2022-02-10T00:28:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } } ] } }, "v13": { "createdDate": "2022-04-12T19:16:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } } ] } }, "v14": { "createdDate": "2023-01-12T23:55:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com", "autoscaling.amazonaws.com.cn", "events.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:TagResource", "servicecatalog:UntagResource" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:TagResource", "logs:UntagResource" ], "Resource": "arn:aws:logs:*:*:log-group:LaunchWizard*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } } ] } }, "v15": { "createdDate": "2023-02-22T17:25:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLog*", "logs:PutLogEvents", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*", "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript" ] }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Effect": "Allow", "Action": [ "logs:DeleteLogStream", "logs:GetLogEvents", "logs:PutLogEvents", "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "logs:CreateLogGroup", "logs:GetLogDelivery", "logs:GetLogRecord", "logs:ListLogDeliveries", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "tag:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": "logs:GetLog*", "Resource": [ "arn:aws:logs:*:*:log-group:*:*:*", "arn:aws:logs:*:*:log-group:LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com", "autoscaling.amazonaws.com.cn", "events.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:TagResource", "servicecatalog:UntagResource" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "elasticfilesystem:UntagResource", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:TagResource", "logs:UntagResource" ], "Resource": "arn:aws:logs:*:*:log-group:LaunchWizard*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } } ] } } }, "createdDate": "2020-08-06T17:47:30.000Z", "lastUpdatedDate": "2023-02-22T17:25:14.000Z" }, "AmazonBraketFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonBraketFullAccess", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2020-08-06T20:12:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket:*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListNotebookInstances", "sagemaker:ListTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/aws-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/aws-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2021-02-18T07:48:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket:*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Action": [ "iam:PassRole" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2021-11-26T19:32:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } }, "v4": { "createdDate": "2021-11-28T05:31:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } }, "v5": { "createdDate": "2022-03-31T19:03:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } }, "v6": { "createdDate": "2023-04-19T16:25:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "servicequotas:GetServiceQuota", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } }, "v7": { "createdDate": "2020-08-06T20:12:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "servicequotas:GetServiceQuota", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListNotebookInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateNotebookInstance", "sagemaker:DeleteNotebookInstance", "sagemaker:DescribeNotebookInstance", "sagemaker:StartNotebookInstance", "sagemaker:StopNotebookInstance", "sagemaker:UpdateNotebookInstance", "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance/amazon-braket-*" }, { "Effect": "Allow", "Action": [ "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:UpdateNotebookInstanceLifecycleConfig" ], "Resource": "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/amazon-braket-*" }, { "Effect": "Allow", "Action": "braket:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/braket.amazonaws.com/AWSServiceRoleForAmazonBraket*", "Condition": { "StringEquals": { "iam:AWSServiceName": "braket.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketServiceSageMakerNotebookRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } } }, "createdDate": "2020-08-06T20:12:37.000Z", "lastUpdatedDate": "2025-04-01T22:52:06.000Z" }, "AWSLambdaMSKExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaMSKExecutionRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2022-08-02T20:08:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:GetBootstrapBrokers", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-08-11T17:35:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:DescribeCluster", "kafka:GetBootstrapBrokers", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-11T17:35:05.000Z", "lastUpdatedDate": "2022-08-02T20:08:02.000Z" }, "AWSCompromisedKeyQuarantine": { "arn": "arn:aws:iam::aws:policy/AWSCompromisedKeyQuarantine", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-11T18:04:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateUser", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "lambda:CreateFunction", "lightsail:Create*", "lightsail:Start*", "lightsail:Delete*", "lightsail:Update*", "lightsail:GetInstanceAccessDetails", "lightsail:DownloadDefaultKeyPair" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-08-11T18:04:13.000Z", "lastUpdatedDate": "2020-08-11T18:04:13.000Z" }, "ServerMigration_ServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/ServerMigration_ServiceRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-08-11T20:41:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Condition": { "Null": { "cloudformation:ResourceTypes": "false" }, "ForAllValues:StringEquals": { "cloudformation:ResourceTypes": [ "AWS::EC2::Instance" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*" }, { "Effect": "Allow", "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:s3:::sms-app-*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ssm:resourceTag/UseForSMSApplicationValidation": [ "true" ] } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeSnapshotAttribute", "ec2:DeregisterImage", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "cloudformation.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } }, "v2": { "createdDate": "2020-10-15T17:26:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*", "Condition": { "Null": { "cloudformation:ResourceTypes": "false" }, "ForAllValues:StringEquals": { "cloudformation:ResourceTypes": [ "AWS::EC2::Instance", "AWS::ApplicationInsights::Application", "AWS::ResourceGroups::Group" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::sms-app-*" }, { "Effect": "Allow", "Action": [ "sms:CreateReplicationJob", "sms:DeleteReplicationJob", "sms:GetReplicationJobs", "sms:GetReplicationRuns", "sms:GetServers", "sms:ImportServerCatalog", "sms:StartOnDemandReplicationRun", "sms:UpdateReplicationJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:s3:::sms-app-*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ssm:resourceTag/UseForSMSApplicationValidation": [ "true" ] } } }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CopySnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CopySnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/SMSJobId": [ "sms-*" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CopyImage", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeSnapshotAttribute", "ec2:DeregisterImage", "ec2:ImportImage", "ec2:DescribeImportImageTasks", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetInstanceProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "cloudformation.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*" } } } ] } } }, "createdDate": "2020-08-11T20:41:44.000Z", "lastUpdatedDate": "2020-10-15T17:26:32.000Z" }, "AmazonEKSVPCResourceController": { "arn": "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-12T00:55:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateNetworkInterfacePermission", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "ec2:ResourceTag/eks:eni:owner": "eks-vpc-resource-controller" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DetachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:UnassignPrivateIpAddresses", "ec2:AssignPrivateIpAddresses" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-12T00:55:34.000Z", "lastUpdatedDate": "2020-08-12T00:55:34.000Z" }, "Route53ResolverServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-12T17:47:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups", "s3:GetBucketPolicy" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-08-12T17:47:24.000Z", "lastUpdatedDate": "2020-08-12T17:47:24.000Z" }, "ClientVPNServiceConnectionsRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ClientVPNServiceConnectionsRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-12T19:48:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:AWSClientVPN-*" } ] } } }, "createdDate": "2020-08-12T19:48:06.000Z", "lastUpdatedDate": "2020-08-12T19:48:06.000Z" }, "AWSCodeDeployRoleForLambdaLimited": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-17T17:14:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:DescribeAlarms", "lambda:UpdateAlias", "lambda:GetAlias", "lambda:GetProvisionedConcurrencyConfig" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:CodeDeployHook_*", "Effect": "Allow" } ] } } }, "createdDate": "2020-08-17T17:14:14.000Z", "lastUpdatedDate": "2020-08-17T17:14:14.000Z" }, "AmazonEC2RoleforAWSCodeDeployLimited": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeployLimited", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-08-24T17:55:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } }, "Effect": "Allow" } ] } }, "v2": { "createdDate": "2022-01-20T21:37:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*/CodeDeploy/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/UseWithCodeDeploy": "true" } } } ] } } }, "createdDate": "2020-08-24T17:55:18.000Z", "lastUpdatedDate": "2022-01-20T21:37:31.000Z" }, "AWSApplicationAutoscalingKafkaClusterPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingKafkaClusterPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-24T18:36:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafka:DescribeCluster", "kafka:DescribeClusterOperation", "kafka:UpdateBrokerStorage", "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-08-24T18:36:01.000Z", "lastUpdatedDate": "2020-08-24T18:36:01.000Z" }, "AWSTransferReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSTransferReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-27T17:54:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "transfer:DescribeUser", "transfer:DescribeServer", "transfer:ListUsers", "transfer:ListServers", "transfer:TestIdentityProvider", "transfer:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-27T17:54:51.000Z", "lastUpdatedDate": "2020-08-27T17:54:51.000Z" }, "AWSBillingReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:ViewBilling" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-03-08T17:48:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-28T19:56:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-07-26T18:05:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:ListCostAllocationTags", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "payments:ListTagsForResource", "payments:ListPaymentInstruments", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:BatchGetInvoiceProfile", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:GetInvoiceUnit", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", "invoicing:ListTagsForResource", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2020-08-27T20:08:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "account:GetAccountInformation", "aws-portal:ViewBilling", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetCredits", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "budgets:ViewBudget", "budgets:DescribeBudgetActionsForBudget", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionHistories", "ce:DescribeCostCategoryDefinition", "ce:GetCostAndUsage", "ce:ListCostCategoryDefinitions", "ce:ListTagsForResource", "ce:ListCostAllocationTags", "ce:ListCostAllocationTagBackfillHistory", "ce:GetTags", "ce:GetDimensionValues", "consolidatedbilling:ListLinkedAccounts", "consolidatedbilling:GetAccountBillingRole", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:DescribeReportDefinitions", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:BatchGetInvoiceProfile", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:GetInvoiceUnit", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", "invoicing:ListTagsForResource", "mapcredits:ListQuarterSpend", "mapcredits:ListAssociatedPrograms", "mapcredits:ListQuarterCredits", "payments:GetFinancingApplication", "payments:GetFinancingLine", "payments:GetFinancingLineWithdrawal", "payments:GetFinancingOption", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListFinancingApplications", "payments:ListFinancingLines", "payments:ListFinancingLineWithdrawals", "payments:ListPaymentInstruments", "payments:ListPaymentPreferences", "payments:ListPaymentProgramOptions", "payments:ListPaymentProgramStatus", "payments:ListTagsForResource", "purchase-orders:GetPurchaseOrder", "purchase-orders:ViewPurchaseOrders", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:ListTagsForResource", "sustainability:GetCarbonFootprintSummary", "tax:GetTaxRegistrationDocument", "tax:GetTaxInheritance", "tax:ListTaxRegistrations" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-27T20:08:51.000Z", "lastUpdatedDate": "2025-03-12T18:07:07.000Z" }, "ElementalActivationsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/ElementalActivationsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-28T16:51:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-activations:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-28T16:51:01.000Z", "lastUpdatedDate": "2020-08-28T16:51:01.000Z" }, "ElementalActivationsGenerateLicenses": { "arn": "arn:aws:iam::aws:policy/ElementalActivationsGenerateLicenses", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-08-28T18:28:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-activations:Get*", "elemental-activations:GenerateLicenses", "elemental-activations:StartFileUpload", "elemental-activations:CompleteFileUpload" ], "Resource": "*" } ] } } }, "createdDate": "2020-08-28T18:28:58.000Z", "lastUpdatedDate": "2020-08-28T18:28:58.000Z" }, "ElementalActivationsDownloadSoftwareAccess": { "arn": "arn:aws:iam::aws:policy/ElementalActivationsDownloadSoftwareAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-08T17:26:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-activations:Get*", "elemental-activations:Download*" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-08T17:26:09.000Z", "lastUpdatedDate": "2020-09-08T17:26:09.000Z" }, "AWSQuickSightElasticsearchPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightElasticsearchPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-09-09T17:27:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cat/indices" ] }, { "Effect": "Allow", "Action": "es:ListDomainNames", "Resource": "*" }, { "Effect": "Allow", "Action": [ "es:DescribeElasticsearchDomain" ], "Resource": [ "arn:aws:es:*:*:domain/*" ] }, { "Effect": "Allow", "Action": [ "es:ESHttpPost", "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/_opendistro/_sql" ] } ] } }, "v2": { "createdDate": "2020-10-15T17:09:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cluster/settings", "arn:aws:es:*:*:domain/*/_cat/indices" ] }, { "Effect": "Allow", "Action": "es:ListDomainNames", "Resource": "*" }, { "Effect": "Allow", "Action": [ "es:DescribeElasticsearchDomain" ], "Resource": [ "arn:aws:es:*:*:domain/*" ] }, { "Effect": "Allow", "Action": [ "es:ESHttpPost", "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/_opendistro/_sql" ] } ] } }, "v3": { "createdDate": "2021-09-07T23:25:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cluster/settings", "arn:aws:es:*:*:domain/*/_cat/indices" ] }, { "Effect": "Allow", "Action": "es:ListDomainNames", "Resource": "*" }, { "Effect": "Allow", "Action": [ "es:DescribeElasticsearchDomain", "es:DescribeDomain" ], "Resource": [ "arn:aws:es:*:*:domain/*" ] }, { "Effect": "Allow", "Action": [ "es:ESHttpPost", "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/_opendistro/_sql", "arn:aws:es:*:*:domain/*/_plugin/_sql" ] } ] } } }, "createdDate": "2020-09-09T17:27:19.000Z", "lastUpdatedDate": "2021-09-07T23:25:55.000Z" }, "AmazonRedshiftDataFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2020-09-09T19:23:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataAPIPermissions", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Action": [ "secretsmanager:GetSecretValue" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "GetCredentialsForAPIUser", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "DenyCreateAPIUser", "Effect": "Deny", "Action": "redshift:CreateClusterUser", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "ServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift-data.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-07-27T20:05:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataAPIPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "GetCredentialsForAPIUser", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "DenyCreateAPIUser", "Effect": "Deny", "Action": "redshift:CreateClusterUser", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "ServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift-data.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-07-08T01:44:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataAPIPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "GetCredentialsForAPIUser", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "GetCredentialsForServerless", "Effect": "Allow", "Action": "redshift-serverless:GetCredentials", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "DenyCreateAPIUser", "Effect": "Deny", "Action": "redshift:CreateClusterUser", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "ServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift-data.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-07-12T03:34:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataAPIPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "GetCredentialsForAPIUser", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "GetCredentialsForServerless", "Effect": "Allow", "Action": "redshift-serverless:GetCredentials", "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "DenyCreateAPIUser", "Effect": "Deny", "Action": "redshift:CreateClusterUser", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "ServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift-data.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2023-04-07T18:18:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataAPIPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ListStatements", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "GetCredentialsForAPIUser", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "GetCredentialsWithFederatedIAMCredentials", "Effect": "Allow", "Action": "redshift:GetClusterCredentialsWithIAM", "Resource": "arn:aws:redshift:*:*:dbname:*/*" }, { "Sid": "GetCredentialsForServerless", "Effect": "Allow", "Action": "redshift-serverless:GetCredentials", "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "StringLike": { "aws:ResourceTag/RedshiftDataFullAccess": "*" } } }, { "Sid": "DenyCreateAPIUser", "Effect": "Deny", "Action": "redshift:CreateClusterUser", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Sid": "ServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift", "Condition": { "StringLike": { "iam:AWSServiceName": "redshift-data.amazonaws.com" } } } ] } } }, "createdDate": "2020-09-09T19:23:55.000Z", "lastUpdatedDate": "2023-04-07T18:18:32.000Z" }, "AWSRoboMaker_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSRoboMaker_FullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-09-10T18:34:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "robomaker:*", "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-09-16T21:06:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "robomaker:*", "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ecr:BatchGetImage", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ecr-public:DescribeImages", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "robomaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "robomaker.amazonaws.com" } } } ] } } }, "createdDate": "2020-09-10T18:34:18.000Z", "lastUpdatedDate": "2021-09-16T21:06:10.000Z" }, "AWS_ConfigRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole", "latestVersionId": "v35", "versionsCount": 35, "versions": { "v2": { "createdDate": "2020-12-18T22:10:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "eks:DescribeCluster", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "eks:DescribeCluster", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-01-29T19:24:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:GetBackupSelection", "cloudfront:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "s3:GetAccelerateConfiguration", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-03-31T21:44:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:ListBackupPlans", "backup:GetBackupPlan", "backup:ListBackupVaults", "backup:DescribeBackupVault", "backup:GetBackupVaultNotifications", "backup:GetBackupVaultAccessPolicy", "backup:ListBackupSelections", "backup:GetBackupSelection", "backup:ListRecoveryPointsByBackupVault", "backup:DescribeRecoveryPoint", "backup:ListTags", "cloudfront:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamSummary", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-05-11T00:14:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamSummary", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "logs:DescribeLogGroups", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:describeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-06-07T23:02:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeNotebookInstance", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "storagegateway:ListGateways", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-07-27T22:41:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-09-08T18:09:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "es:DescribeDomain", "es:DescribeDomains", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBParameters", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2022-03-11T21:35:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:ListTags", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "guardduty:ListOrganizationAdminAccounts", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v9": { "createdDate": "2022-01-21T18:35:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "es:DescribeDomain", "es:DescribeDomains", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "rds:DescribeDBParameters", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v10": { "createdDate": "2022-02-10T18:35:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeStateMachine", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v13": { "createdDate": "2022-05-27T03:11:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListTagsForResource", "detective:ListGraphs", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:ListConfigurationSets", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v12": { "createdDate": "2022-04-06T21:41:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks", "dms:DescribeReplicationSubnetGroups", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMasterAccount", "guardduty:ListDetectors", "guardduty:ListFindings", "guardduty:ListOrganizationAdminAccounts", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "kafka:DescribeCluster", "kafka:ListClusters", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v14": { "createdDate": "2022-07-15T01:37:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ExportThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListBillingGroups", "billingconductor:ListAccountAssociations", "billingconductor:ListTagsForResource", "billingconductor:ListPricingRules", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListTagsForResource", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeArchive", "events:DescribeApiDestination", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:ListPolicies", "fms:GetPolicy", "fms:ListTagsForResource", "fms:GetNotificationChannel", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "geo:DescribeTracker", "geo:ListTrackerConsumers", "geo:DescribeGeofenceCollection", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeMap", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListInfrastructureConfigurations", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:ListTagsForResource", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v15": { "createdDate": "2022-08-19T22:05:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ExportThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeRecoveryPoint", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListBillingGroups", "billingconductor:ListAccountAssociations", "billingconductor:ListTagsForResource", "billingconductor:ListPricingRules", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListTagsForResource", "datasync:ListLocations", "datasync:ListTasks", "datasync:ListAgents", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeArchive", "events:DescribeApiDestination", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:ListPolicies", "fms:GetPolicy", "fms:ListTagsForResource", "fms:GetNotificationChannel", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "geo:DescribeTracker", "geo:ListTrackerConsumers", "geo:DescribeGeofenceCollection", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeMap", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListInfrastructureConfigurations", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "macie2:GetMacieSession", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:ListTagsForResource", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListTagsForResource", "servicediscovery:ListServices", "servicediscovery:ListNamespaces", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "tag:GetResources", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v17": { "createdDate": "2022-09-14T19:21:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStream", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListMaps", "geo:ListTrackerConsumers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListCertificates", "iot:ListDimensions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssets", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetInAppTemplate", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v18": { "createdDate": "2022-10-18T17:17:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v16": { "createdDate": "2022-09-07T20:46:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStream", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListMaps", "geo:ListTrackerConsumers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListCertificates", "iot:ListDimensions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssets", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetInAppTemplate", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeLayers", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v19": { "createdDate": "2022-10-31T19:24:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v20": { "createdDate": "2023-01-05T22:14:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v24": { "createdDate": "2023-04-12T22:09:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:ListApps", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetProject", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "groundstation:GetConfig", "groundstation:ListConfigs", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApp", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "refactor-spaces:GetEnvironment", "refactor-spaces:ListEnvironments", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModels", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v21": { "createdDate": "2023-01-30T21:21:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appstream:DescribeDirectoryConfigs", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v22": { "createdDate": "2023-03-02T22:08:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appstream:DescribeDirectoryConfigs", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:ListDistributions", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListNetworkProfiles", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfilesForRole", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v23": { "createdDate": "2023-03-21T18:15:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "apprunner:DescribeService", "apprunner:ListServices", "apprunner:ListTagsForResource", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetProject", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "groundstation:GetConfig", "groundstation:ListConfigs", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:ListClusters", "kafka:ListClustersV2", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListTagsLogGroup", "logs:ListLogDeliveries", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:GetMacieSession", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApp", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mobiletargeting:ListTagsForResource", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeOrganization", "organizations:DescribePolicy", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListTagsForResource", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListUsers", "transfer:ListWorkflows", "transfer:ListTagsForResource", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v25": { "createdDate": "2023-06-09T00:15:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeMitigationAction", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v26": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribePhoneNumber", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:ListFilters", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:GetConnectPeer", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrCollections", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v27": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeInstance", "connect:DescribePhoneNumber", "connect:DescribeQuickConnect", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListQuickConnects", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrCollections", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v28": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v29": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeMetricFilters", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v30": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v31": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeFlow", "mediaconnect:ListFlows", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "ssm-sap:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v32": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "apigateway:GET", "app-integrations:GetEventIntegration", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQuickConnect", "connect:DescribeRule", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQuickConnects", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "omics:GetWorkflow", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:ListSchedules", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v33": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "apigateway:GET", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetWorkflow", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v34": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "apigateway:GET", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListTrainingDatasets", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "comprehend:DescribeFlywheel", "comprehend:ListFlywheels", "comprehend:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetAnnotationStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:ListAnnotationStores", "omics:ListRunGroups", "omics:ListSequenceStores", "omics:ListTagsForResource", "omics:ListVariantStores", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListDedicatedIpPools", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } }, "v35": { "createdDate": "2020-09-15T20:30:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSConfigRoleStatementID", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", "acm-pca:ListTags", "acm:DescribeCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "airflow:GetEnvironment", "airflow:ListEnvironments", "airflow:ListTagsForResource", "amplify:GetApp", "amplify:GetBranch", "amplify:ListApps", "amplify:ListBranches", "amplifyuibuilder:ExportThemes", "amplifyuibuilder:GetTheme", "amplifyuibuilder:ListThemes", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListVpcEndpoints", "apigateway:GET", "app-integrations:GetApplication", "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrationAssociations", "app-integrations:ListEventIntegrations", "app-integrations:ListTagsForResource", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetDeployment", "appconfig:GetDeploymentStrategy", "appconfig:GetEnvironment", "appconfig:GetExtension", "appconfig:GetExtensionAssociation", "appconfig:GetHostedConfigurationVersion", "appconfig:ListApplications", "appconfig:ListConfigurationProfiles", "appconfig:ListDeployments", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", "appconfig:ListExtensions", "appconfig:ListHostedConfigurationVersions", "appconfig:ListTagsForResource", "appflow:DescribeConnectorProfiles", "appflow:DescribeFlow", "appflow:ListFlows", "appflow:ListTagsForResource", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "appmesh:DescribeGatewayRoute", "appmesh:DescribeMesh", "appmesh:DescribeRoute", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:DescribeVirtualRouter", "appmesh:DescribeVirtualService", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", "appmesh:ListTagsForResource", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", "apprunner:DescribeService", "apprunner:DescribeVpcConnector", "apprunner:ListServices", "apprunner:ListTagsForResource", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlockBuilders", "appstream:DescribeApplications", "appstream:DescribeDirectoryConfigs", "appstream:DescribeFleets", "appstream:DescribeStacks", "appstream:ListTagsForResource", "appsync:GetApiCache", "appsync:GetGraphqlApi", "appsync:ListGraphqlApis", "aps:DescribeAlertManagerDefinition", "aps:DescribeLoggingConfiguration", "APS:DescribeRuleGroupsNamespace", "APS:DescribeWorkspace", "aps:ListRuleGroupsNamespaces", "aps:ListTagsForResource", "APS:ListWorkspaces", "athena:GetDataCatalog", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:ListDataCatalogs", "athena:ListPreparedStatements", "athena:ListTagsForResource", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:GetAssessment", "auditmanager:ListAssessments", "autoscaling-plans:DescribeScalingPlanResources", "autoscaling-plans:DescribeScalingPlans", "autoscaling-plans:GetScalingPlanResourceForecastData", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribePolicies", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeWarmPool", "backup-gateway:ListTagsForResource", "backup-gateway:ListVirtualMachines", "backup:DescribeBackupVault", "backup:DescribeFramework", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeReportPlan", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListFrameworks", "backup:ListRecoveryPointsByBackupVault", "backup:ListReportPlans", "backup:ListRestoreTestingPlans", "backup:ListRestoreTestingSelections", "backup:ListTags", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:ListSchedulingPolicies", "batch:ListTagsForResource", "billingconductor:ListAccountAssociations", "billingconductor:ListBillingGroups", "billingconductor:ListCustomLineItems", "billingconductor:ListPricingPlans", "billingconductor:ListPricingRules", "billingconductor:ListPricingRulesAssociatedToPricingPlan", "billingconductor:ListTagsForResource", "budgets:DescribeBudgetAction", "budgets:DescribeBudgetActionsForAccount", "budgets:DescribeBudgetActionsForBudget", "budgets:ViewBudget", "cassandra:Select", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:ListTrainingDatasets", "cloud9:DescribeEnvironmentMemberships", "cloud9:DescribeEnvironments", "cloud9:ListEnvironments", "cloud9:ListTagsForResource", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ListTypes", "cloudfront:GetFunction", "cloudfront:GetOriginAccessControl", "cloudfront:GetResponseHeadersPolicy", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", "cloudtrail:DescribeTrails", "cloudTrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrailStatus", "cloudTrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:GetDashboard", "cloudwatch:GetMetricStream", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "cloudwatch:ListTagsForResource", "codeartifact:DescribeRepository", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListPackages", "codeartifact:ListPackageVersions", "codeartifact:ListRepositories", "codeartifact:ListTagsForResource", "codebuild:BatchGetReportGroups", "codebuild:ListReportGroups", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:ListRepositories", "codecommit:ListTagsForResource", "codedeploy:GetDeploymentConfig", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:ListPipelines", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:GetPrincipalTagAttributeMap", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "comprehend:DescribeFlywheel", "comprehend:ListFlywheels", "comprehend:ListTagsForResource", "config:BatchGet*", "config:Describe*", "config:Get*", "config:List*", "config:Put*", "config:Select*", "connect:DescribeEvaluationForm", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribePhoneNumber", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeUser", "connect:GetTaskTemplate", "connect:ListApprovedOrigins", "connect:ListEvaluationForms", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListPhoneNumbers", "connect:ListPhoneNumbersV2", "connect:ListPrompts", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListUsers", "connect:SearchAvailablePhoneNumbers", "databrew:DescribeDataset", "databrew:DescribeJob", "databrew:DescribeProject", "databrew:DescribeRecipe", "databrew:DescribeRuleset", "databrew:DescribeSchedule", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:DescribeAgent", "datasync:DescribeLocationEfs", "datasync:DescribeLocationFsxLustre", "datasync:DescribeLocationFsxWindows", "datasync:DescribeLocationHdfs", "datasync:DescribeLocationNfs", "datasync:DescribeLocationObjectStorage", "datasync:DescribeLocationS3", "datasync:DescribeLocationSmb", "datasync:DescribeTask", "datasync:ListAgents", "datasync:ListLocations", "datasync:ListTagsForResource", "datasync:ListTasks", "datazone:GetDomain", "datazone:ListDomains", "dax:DescribeClusters", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "detective:ListGraphs", "detective:ListTagsForResource", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:ListInstanceProfiles", "devicefarm:ListNetworkProfiles", "devicefarm:ListProjects", "devicefarm:ListTagsForResource", "devicefarm:ListTestGridProjects", "devops-guru:GetResourceCollection", "devops-guru:ListNotificationChannels", "dms:DescribeCertificates", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTaskAssessmentRuns", "dms:DescribeReplicationTasks", "dms:ListTagsForResource", "ds:DescribeDirectories", "ds:DescribeDomainControllers", "ds:DescribeEventTopics", "ds:ListLogSubscriptions", "ds:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:Describe*", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeDhcpOptions", "ec2:DescribeFleets", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSpotFleetRequests", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:GetAllowedImagesSettings", "ec2:GetEbsEncryptionByDefault", "ec2:GetInstanceTypesFromInstanceRequirements", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ecr-public:DescribeRepositories", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRepositoryPolicy", "ecr-public:ListTagsForResource", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribePullThroughCacheRules", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:ListAddons", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "elasticbeanstalk:DescribeConfigurationSettings", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeBackupPolicy", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeTags", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeStudio", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListStudios", "elasticmapreduce:ListStudioSessionMappings", "emr-containers:DescribeVirtualCluster", "emr-containers:ListVirtualClusters", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "es:DescribeDomain", "es:DescribeDomains", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:GetCompatibleElasticsearchVersions", "es:GetCompatibleVersions", "es:ListDomainNames", "es:ListTags", "events:DescribeApiDestination", "events:DescribeArchive", "events:DescribeConnection", "events:DescribeEndpoint", "events:DescribeEventBus", "events:DescribeRule", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "events:ListTagsForResource", "events:ListTargetsByRule", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:ListLaunches", "evidently:ListProjects", "evidently:ListSegments", "evidently:ListTagsForResource", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:ListPolicies", "fms:ListTagsForResource", "forecast:DescribeDataset", "forecast:DescribeDatasetGroup", "forecast:ListDatasetGroups", "forecast:ListDatasets", "forecast:ListTagsForResource", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "fsx:DescribeBackups", "fsx:DescribeDataRepositoryAssociations", "fsx:DescribeFileSystems", "fsx:DescribeSnapshots", "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "gamelift:DescribeAlias", "gamelift:DescribeBuild", "gamelift:DescribeFleetAttributes", "gamelift:DescribeFleetCapacity", "gamelift:DescribeFleetLocationAttributes", "gamelift:DescribeFleetLocationCapacity", "gamelift:DescribeFleetPortSettings", "gamelift:DescribeGameServerGroup", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:DescribeRuntimeConfiguration", "gamelift:DescribeScript", "gamelift:DescribeVpcPeeringAuthorizations", "gamelift:DescribeVpcPeeringConnections", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListFleets", "gamelift:ListGameServerGroups", "gamelift:ListScripts", "gamelift:ListTagsForResource", "geo:DescribeGeofenceCollection", "geo:DescribeMap", "geo:DescribePlaceIndex", "geo:DescribeRouteCalculator", "geo:DescribeTracker", "geo:ListGeofenceCollections", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListRouteCalculators", "geo:ListTrackerConsumers", "geo:ListTrackers", "globalaccelerator:DescribeAccelerator", "globalaccelerator:DescribeEndpointGroup", "globalaccelerator:DescribeListener", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "globalaccelerator:ListTagsForResource", "glue:BatchGetDevEndpoints", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetCrawler", "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDevEndpoint", "glue:GetDevEndpoints", "glue:GetJob", "glue:GetJobs", "glue:GetMLTransform", "glue:GetMLTransforms", "glue:GetPartition", "glue:GetPartitions", "glue:GetRegistry", "glue:GetSecurityConfiguration", "glue:GetSecurityConfigurations", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:GetWorkflow", "glue:ListCrawlers", "glue:ListDevEndpoints", "glue:ListJobs", "glue:ListMLTransforms", "glue:ListRegistries", "glue:ListTriggers", "glue:ListWorkflows", "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:DescribeWorkspaceConfiguration", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetComponent", "greengrass:ListComponents", "greengrass:ListComponentVersions", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "groundstation:ListTagsForResource", "guardduty:DescribePublishingDestination", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListPublishingDestinations", "guardduty:ListTagsForResource", "guardduty:ListThreatIntelSets", "healthlake:DescribeFHIRDatastore", "healthlake:ListFHIRDatastores", "healthlake:ListTagsForResource", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:ListMFADeviceTags", "iam:ListOpenIDConnectProviders", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "imagebuilder:ListLifecyclePolicies", "inspector2:BatchGetAccountStatus", "inspector2:GetDelegatedAdminAccount", "inspector2:ListFilters", "inspector2:ListMembers", "iot:DescribeAccountAuditConfiguration", "iot:DescribeAuthorizer", "iot:DescribeBillingGroup", "iot:DescribeCACertificate", "iot:DescribeCertificate", "iot:DescribeCustomMetric", "iot:DescribeDimension", "iot:DescribeDomainConfiguration", "iot:DescribeFleetMetric", "iot:DescribeJobTemplate", "iot:DescribeMitigationAction", "iot:DescribeProvisioningTemplate", "iot:DescribeRoleAlias", "iot:DescribeScheduledAudit", "iot:DescribeSecurityProfile", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:GetPolicy", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:ListAuthorizers", "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListDomainConfigurations", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", "iot:ListSecurityProfilesForTarget", "iot:ListTagsForResource", "iot:ListTargetsForSecurityProfile", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iot:ListV2LoggingLevels", "iot:ValidateSecurityProfileBehaviors", "iotanalytics:DescribeChannel", "iotanalytics:DescribeDataset", "iotanalytics:DescribeDatastore", "iotanalytics:DescribePipeline", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotanalytics:ListTagsForResource", "iotevents:DescribeAlarmModel", "iotevents:DescribeDetectorModel", "iotevents:DescribeInput", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotevents:ListTagsForResource", "iotfleetwise:GetDecoderManifest", "iotfleetwise:GetFleet", "iotfleetwise:GetModelManifest", "iotfleetwise:GetSignalCatalog", "iotfleetwise:GetVehicle", "iotfleetwise:ListDecoderManifestNetworkInterfaces", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListDecoderManifestSignals", "iotfleetwise:ListFleets", "iotfleetwise:ListModelManifestNodes", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogNodes", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListTagsForResource", "iotfleetwise:ListVehicles", "iotsitewise:DescribeAccessPolicy", "iotsitewise:DescribeAsset", "iotsitewise:DescribeAssetModel", "iotsitewise:DescribeDashboard", "iotsitewise:DescribeGateway", "iotsitewise:DescribePortal", "iotsitewise:DescribeProject", "iotsitewise:ListAccessPolicies", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjectAssets", "iotsitewise:ListProjects", "iotsitewise:ListTagsForResource", "iottwinmaker:GetComponentType", "iottwinmaker:GetEntity", "iottwinmaker:GetScene", "iottwinmaker:GetSyncJob", "iottwinmaker:GetWorkspace", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListTagsForResource", "iottwinmaker:ListWorkspaces", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:ListDestinations", "iotwireless:ListDeviceProfiles", "iotwireless:ListFuotaTasks", "iotwireless:ListMulticastGroups", "iotwireless:ListServiceProfiles", "iotwireless:ListTagsForResource", "iotwireless:ListWirelessDevices", "iotwireless:ListWirelessGateways", "iotwireless:ListWirelessGatewayTaskDefinitions", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStorageConfiguration", "ivs:GetStreamKey", "ivs:ListChannels", "ivs:ListEncoderConfigurations", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListTagsForResource", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "ivschat:ListTagsForResource", "kafka:DescribeCluster", "kafka:DescribeClusterV2", "kafka:DescribeConfiguration", "kafka:DescribeConfigurationRevision", "kafka:DescribeVpcConnection", "kafka:GetClusterPolicy", "kafka:ListClusters", "kafka:ListClustersV2", "kafka:ListConfigurations", "kafka:ListScramSecrets", "kafka:ListTagsForResource", "kafka:ListVpcConnections", "kafkaconnect:DescribeConnector", "kafkaconnect:ListConnectors", "kendra:DescribeIndex", "kendra:ListIndices", "kendra:ListTagsForResource", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesisanalytics:DescribeApplication", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kinesisvideo:DescribeSignalingChannel", "kinesisvideo:DescribeStream", "kinesisvideo:ListSignalingChannels", "kinesisvideo:ListStreams", "kinesisvideo:ListTagsForResource", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lakeformation:DescribeResource", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "lakeformation:ListResources", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetLayerVersion", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lex:DescribeBot", "lex:DescribeBotAlias", "lex:DescribeBotVersion", "lex:DescribeResourcePolicy", "lex:ListBotAliases", "lex:ListBotLocales", "lex:ListBots", "lex:ListBotVersions", "lex:ListTagsForResource", "license-manager:GetGrant", "license-manager:GetLicense", "license-manager:ListDistributedGrants", "license-manager:ListLicenses", "license-manager:ListReceivedGrants", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDistributions", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetKeyPair", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabaseParameters", "lightsail:GetRelationalDatabases", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:GetDataProtectionPolicy", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:ListLogAnomalyDetectors", "logs:ListLogDeliveries", "logs:ListTagsLogGroup", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListTagsForResource", "lookoutmetrics:DescribeAlert", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:ListMetricSets", "lookoutmetrics:ListTagsForResource", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:GetEnvironment", "m2:ListEnvironments", "m2:ListTagsForResource", "macie2:DescribeOrganizationConfiguration", "macie2:GetAutomatedDiscoveryConfiguration", "macie2:GetClassificationExportConfiguration", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsPublicationConfiguration", "macie2:GetMacieSession", "macie2:ListCustomDataIdentifiers", "macie2:ListTagsForResource", "managedblockchain:GetMember", "managedblockchain:GetNetwork", "managedblockchain:GetNode", "managedblockchain:ListInvitations", "managedblockchain:ListMembers", "managedblockchain:ListNodes", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeGateway", "mediaconnect:ListBridges", "mediaconnect:ListFlows", "mediaconnect:ListGateways", "mediaconnect:ListTagsForResource", "mediapackage-vod:DescribePackagingConfiguration", "mediapackage-vod:DescribePackagingGroup", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage-vod:ListTagsForResource", "mediatailor:DescribeChannel", "mediatailor:DescribeLiveSource", "mediatailor:DescribeSourceLocation", "mediatailor:DescribeVodSource", "mediatailor:GetPlaybackConfiguration", "mediatailor:ListChannels", "mediatailor:ListLiveSources", "mediatailor:ListPlaybackConfigurations", "mediatailor:ListSourceLocations", "mediatailor:ListVodSources", "memorydb:DescribeAcls", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeParameters", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "mobiletargeting:GetApp", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetApps", "mobiletargeting:GetCampaign", "mobiletargeting:GetCampaigns", "mobiletargeting:GetEmailChannel", "mobiletargeting:GetEmailTemplate", "mobiletargeting:GetEventStream", "mobiletargeting:GetInAppTemplate", "mobiletargeting:GetSegment", "mobiletargeting:GetSegments", "mobiletargeting:ListTagsForResource", "mobiletargeting:ListTemplates", "mq:DescribeBroker", "mq:ListBrokers", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetConnectPeer", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:ListConnectPeers", "networkmanager:ListTagsForResource", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileDetails", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:ListLaunchProfiles", "nimble:ListStreamingImages", "nimble:ListStudioComponents", "nimble:ListStudios", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", "omics:GetAnnotationStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:ListAnnotationStores", "omics:ListRunGroups", "omics:ListSequenceStores", "omics:ListTagsForResource", "omics:ListVariantStores", "omics:ListWorkflows", "opsworks:DescribeInstances", "opsworks:DescribeLayers", "opsworks:DescribeTimeBasedAutoScaling", "opsworks:DescribeVolumes", "opsworks:ListTags", "organizations:DescribeAccount", "organizations:DescribeEffectivePolicy", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribePolicy", "organizations:DescribeResourcePolicy", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListRoots", "organizations:ListTagsForResource", "organizations:ListTargetsForPolicy", "panorama:DescribeApplicationInstance", "panorama:DescribeApplicationInstanceDetails", "panorama:DescribePackage", "panorama:DescribePackageVersion", "panorama:ListApplicationInstances", "panorama:ListNodes", "panorama:ListPackages", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:ListAliases", "payment-cryptography:ListKeys", "payment-cryptography:ListTagsForResource", "personalize:DescribeDataset", "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeSolution", "personalize:ListDatasetGroups", "personalize:ListDatasetImportJobs", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "personalize:ListTagsForResource", "profile:GetDomain", "profile:GetIntegration", "profile:GetProfileObjectType", "profile:ListDomains", "profile:ListIntegrations", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "quicksight:DescribeAccountSubscription", "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeTemplate", "quicksight:DescribeTemplatePermissions", "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions", "quicksight:ListAnalyses", "quicksight:ListDashboards", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTagsForResource", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetPermission", "ram:GetResourceShareAssociations", "ram:GetResourceShares", "ram:ListPermissionAssociations", "ram:ListPermissions", "ram:ListPermissionVersions", "ram:ListResources", "ram:ListResourceSharePermissions", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSecurityGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "refactor-spaces:GetEnvironment", "refactor-spaces:GetService", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "rekognition:DescribeStreamProcessor", "rekognition:ListStreamProcessors", "rekognition:ListTagsForResource", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppVersionTemplate", "resiliencehub:DescribeResiliencyPolicy", "resiliencehub:ListApps", "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListTagsForResource", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:ListGroupResources", "resource-groups:ListGroups", "robomaker:DescribeRobotApplication", "robomaker:DescribeSimulationApplication", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:GetChange", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListCidrBlocks", "route53:ListCidrCollections", "route53:ListCidrLocations", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListQueryLoggingConfigs", "route53:ListResourceRecordSets", "route53:ListTagsForResource", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverEndpoint", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallDomains", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListFirewallRules", "route53resolver:ListResolverDnssecConfigs", "route53resolver:ListResolverEndpointIpAddresses", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRuleAssociations", "route53resolver:ListResolverRules", "route53resolver:ListTagsForResource", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessPoint", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatus", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketRequestPayment", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:ListAllMyDirectoryBuckets", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceExperiment", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribeProject", "sagemaker:DescribeWorkteam", "sagemaker:ListAppImageConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceExperiments", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "sagemaker:ListProjects", "sagemaker:ListTags", "sagemaker:ListWorkteams", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "scheduler:ListTagsForResource", "schemas:DescribeDiscoverer", "schemas:DescribeRegistry", "schemas:DescribeSchema", "schemas:GetResourcePolicy", "schemas:ListDiscoverers", "schemas:ListRegistries", "schemas:ListSchemas", "sdb:GetAttributes", "sdb:ListDomains", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "securityhub:DescribeHub", "serviceCatalog:DescribePortfolioShares", "servicediscovery:GetInstance", "servicediscovery:GetNamespace", "servicediscovery:GetService", "servicediscovery:ListInstances", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:ListTagsForResource", "ses:DescribeReceiptRule", "ses:DescribeReceiptRuleSet", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailTemplate", "ses:GetTemplate", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListDedicatedIpPools", "ses:ListEmailTemplates", "ses:ListReceiptFilters", "ses:ListReceiptRuleSets", "ses:ListTemplates", "shield:DescribeDRTAccess", "shield:DescribeProtection", "shield:DescribeSubscription", "signer:GetSigningProfile", "signer:ListProfilePermissions", "signer:ListSigningProfiles", "sns:GetDataProtectionPolicy", "sns:GetSMSSandboxAccountStatus", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTagsForResource", "sns:ListTopics", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ListQueueTags", "ssm-sap:ListTagsForResource", "ssm:DescribeAutomationExecutions", "ssm:DescribeDocument", "ssm:DescribeDocumentPermission", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetDocument", "ssm:GetServiceSetting", "ssm:ListDocuments", "ssm:ListTagsForResource", "sso:DescribeInstanceAccessControlAttributeConfiguration", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "sso:ListTagsForResource", "states:DescribeActivity", "states:DescribeStateMachine", "states:ListActivities", "states:ListStateMachines", "states:ListTagsForResource", "storagegateway:ListGateways", "storagegateway:ListTagsForResource", "storagegateway:ListVolumes", "sts:GetCallerIdentity", "support:DescribeCases", "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:DescribeRuntimeVersions", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:ListAssociatedGroups", "synthetics:ListGroupResources", "synthetics:ListGroups", "synthetics:ListTagsForResource", "tag:GetResources", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListTables", "timestream:ListTagsForResource", "transfer:DescribeAgreement", "transfer:DescribeCertificate", "transfer:DescribeConnector", "transfer:DescribeProfile", "transfer:DescribeServer", "transfer:DescribeUser", "transfer:DescribeWorkflow", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListTagsForResource", "transfer:ListUsers", "transfer:ListWorkflows", "voiceid:DescribeDomain", "voiceid:ListTagsForResource", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetTargetGroup", "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "vpc-lattice:ListTargets", "waf-regional:GetLoggingConfiguration", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:ListLoggingConfigurations", "waf:GetLoggingConfiguration", "waf:GetWebACL", "wafv2:GetLoggingConfiguration", "wafv2:GetRuleGroup", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource", "workspaces:DescribeConnectionAliases", "workspaces:DescribeTags", "workspaces:DescribeWorkspaces" ], "Resource": "*" }, { "Sid": "ConfigLogStreamStatementID", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*" }, { "Sid": "ConfigLogEventsStatementID", "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/config/*:log-stream:config-rule-evaluation/*" } ] } } }, "createdDate": "2020-09-15T20:30:30.000Z", "lastUpdatedDate": "2025-02-27T15:37:07.000Z" }, "MediaPackageServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MediaPackageServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-18T17:45:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:/aws/MediaPackage/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/MediaPackage/*" } ] } } }, "createdDate": "2020-09-18T17:45:47.000Z", "lastUpdatedDate": "2020-09-18T17:45:47.000Z" }, "AWSMarketplaceAmiIngestion": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceAmiIngestion", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-25T20:55:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:ModifySnapshotAttribute" ], "Effect": "Allow", "Resource": "arn:aws:ec2:us-east-1::snapshot/snap-*" }, { "Action": [ "ec2:DescribeImageAttribute", "ec2:DescribeImages", "ec2:DescribeSnapshotAttribute", "ec2:ModifyImageAttribute" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-09-25T20:55:10.000Z", "lastUpdatedDate": "2020-09-25T20:55:10.000Z" }, "AmazonElasticMapReducePlacementGroupPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonElasticMapReducePlacementGroupPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-29T00:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Resource": "*", "Effect": "Allow", "Action": [ "ec2:DeletePlacementGroup", "ec2:DescribePlacementGroups" ] }, { "Resource": "arn:aws:ec2:*:*:placement-group/EMR_*", "Effect": "Allow", "Action": [ "ec2:CreatePlacementGroup" ] } ] } } }, "createdDate": "2020-09-29T00:37:08.000Z", "lastUpdatedDate": "2020-09-29T00:37:08.000Z" }, "AmazonElasticFileSystemsUtils": { "arn": "arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-29T15:16:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-29T15:16:47.000Z", "lastUpdatedDate": "2020-09-29T15:16:47.000Z" }, "Ec2ImageBuilderCrossAccountDistributionAccess": { "arn": "arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-30T19:22:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*::image/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:CopyImage", "ec2:ModifyImageAttribute" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-30T19:22:54.000Z", "lastUpdatedDate": "2020-09-30T19:22:54.000Z" }, "AWSQuickSightTimestreamPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightTimestreamPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-09-30T21:47:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:Select", "timestream:CancelQuery", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:DescribeTable", "timestream:DescribeDatabase", "timestream:SelectValues", "timestream:DescribeEndpoints" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-30T21:47:03.000Z", "lastUpdatedDate": "2020-09-30T21:47:03.000Z" }, "AmazonTimestreamReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTimestreamReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-09-30T21:47:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:CancelQuery", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:Select", "timestream:SelectValues" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-26T23:39:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:CancelQuery", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:Select", "timestream:SelectValues", "timestream:DescribeScheduledQuery", "timestream:ListScheduledQueries" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-02-28T18:22:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:CancelQuery", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:Select", "timestream:SelectValues", "timestream:DescribeScheduledQuery", "timestream:ListScheduledQueries", "timestream:DescribeBatchLoadTask", "timestream:ListBatchLoadTasks" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2020-09-30T21:47:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonTimestreamReadOnlyAccess", "Effect": "Allow", "Action": [ "timestream:CancelQuery", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:ListTables", "timestream:ListTagsForResource", "timestream:Select", "timestream:SelectValues", "timestream:DescribeScheduledQuery", "timestream:ListScheduledQueries", "timestream:DescribeBatchLoadTask", "timestream:ListBatchLoadTasks", "timestream:DescribeAccountSettings" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-30T21:47:08.000Z", "lastUpdatedDate": "2024-06-05T19:11:27.000Z" }, "AmazonTimestreamFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTimestreamFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-11-26T23:42:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-09-30T21:47:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } } ] } } }, "createdDate": "2020-09-30T21:47:14.000Z", "lastUpdatedDate": "2021-11-26T23:42:00.000Z" }, "AmazonTimestreamConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTimestreamConsoleFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-09-30T21:47:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory", "dbqms:DescribeQueryHistory" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-05-20T00:48:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-26T23:43:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-02-01T21:37:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "timestream:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:timestream:database-name" }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "kms:ViaService": "timestream.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "dbqms:CreateFavoriteQuery", "dbqms:DescribeFavoriteQueries", "dbqms:UpdateFavoriteQuery", "dbqms:DeleteFavoriteQueries", "dbqms:GetQueryString", "dbqms:CreateQueryHistory", "dbqms:DescribeQueryHistory", "dbqms:UpdateQueryHistory", "dbqms:DeleteQueryHistory" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:ListTopics", "iam:ListRoles" ], "Resource": "*" } ] } } }, "createdDate": "2020-09-30T21:47:18.000Z", "lastUpdatedDate": "2022-02-01T21:37:31.000Z" }, "AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-01T09:49:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ssm:CreateOpsItem" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-10-01T09:49:01.000Z", "lastUpdatedDate": "2020-10-01T09:49:01.000Z" }, "AmazonS3OutpostsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3OutpostsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-02T17:26:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3-outposts:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "datasync:ListTasks", "datasync:ListLocations", "datasync:DescribeTask", "datasync:DescribeLocation*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "outposts:ListOutposts", "outposts:GetOutpost" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-02T17:26:30.000Z", "lastUpdatedDate": "2020-10-02T17:26:30.000Z" }, "AmazonS3OutpostsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-02T18:55:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3-outposts:Get*", "s3-outposts:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "datasync:ListTasks", "datasync:ListLocations", "datasync:DescribeTask", "datasync:DescribeLocation*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "outposts:ListOutposts", "outposts:GetOutpost" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-02T18:55:58.000Z", "lastUpdatedDate": "2020-10-02T18:55:58.000Z" }, "AWSDeepRacerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDeepRacerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-05T22:03:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectAcl", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*DeepRacer*", "arn:aws:s3:::*Deepracer*", "arn:aws:s3:::*deepracer*", "arn:aws:s3:::dr-*", "arn:aws:s3:::*DeepRacer*/*", "arn:aws:s3:::*Deepracer*/*", "arn:aws:s3:::*deepracer*/*", "arn:aws:s3:::dr-*/*" ] } ] } } }, "createdDate": "2020-10-05T22:03:10.000Z", "lastUpdatedDate": "2020-10-05T22:03:10.000Z" }, "CloudWatchLambdaInsightsExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-07T19:27:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda-insights:*" } ] } } }, "createdDate": "2020-10-07T19:27:06.000Z", "lastUpdatedDate": "2020-10-07T19:27:06.000Z" }, "AWSCloudTrail_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2020-10-21T19:40:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:AddPermission", "sns:CreateTopic", "sns:SetTopicAttributes", "sns:GetTopicAttributes" ], "Resource": [ "arn:aws:sns:*:*:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudtrail:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRolePolicy", "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "cloudtrail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:CreateKey", "kms:CreateAlias", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListGlobalTables", "dynamodb:ListTables" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-10-08T23:41:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:AddPermission", "sns:CreateTopic", "sns:SetTopicAttributes", "sns:GetTopicAttributes" ], "Resource": [ "arn:aws:sns:*:*:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy" ], "Resource": [ "arn:aws:s3:::aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudtrail:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRolePolicy", "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "cloudtrail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:CreateKey", "kms:CreateAlias", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-02-22T19:01:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:AddPermission", "sns:CreateTopic", "sns:SetTopicAttributes", "sns:GetTopicAttributes" ], "Resource": [ "arn:aws:sns:*:*:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation", "s3:GetBucketPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudtrail:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:aws-cloudtrail-logs*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRolePolicy", "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "cloudtrail.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:CreateKey", "kms:CreateAlias", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "dynamodb:ListGlobalTables", "dynamodb:ListTables" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-08T23:41:15.000Z", "lastUpdatedDate": "2021-02-22T19:01:00.000Z" }, "AWSSupportServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", "latestVersionId": "v39", "versionsCount": 39, "versions": { "v2": { "createdDate": "2018-08-06T20:57:29.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeFleets", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeStackEvents", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getMetricStatistics", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplications", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:getUser", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeDirectories", "ds:describeSnapshots", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:listStreams", "dynamodb:listTables", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeClassicLinkInstances", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThings", "iot:listTopicRules", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunctionConfiguration", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApplicationSettings", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEndpoint", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeModel", "sagemaker:describeNotebookInstance", "sagemaker:describeTrainingJob", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listModels", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sdb:domainMetadata", "sdb:listDomains", "servicecatalog:describeProduct", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listLaunchPaths", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeChapCredentials", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v1": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeFleets", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeStackEvents", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getMetricStatistics", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplications", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:getUser", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeDirectories", "ds:describeSnapshots", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:listStreams", "dynamodb:listTables", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeClassicLinkInstances", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunctionConfiguration", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApplicationSettings", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEndpoint", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "sdb:domainMetadata", "sdb:listDomains", "servicecatalog:describeProduct", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listLaunchPaths", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeChapCredentials", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2018-11-05T20:12:23.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplications", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:getGroup", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeStream", "dynamodb:listStreams", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeClassicLinkInstances", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:listClusters", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeTags", "elasticloadbalancingv2:describeListenerCertificates", "elasticloadbalancingv2:describeListeners", "elasticloadbalancingv2:describeLoadBalancerAttributes", "elasticloadbalancingv2:describeLoadBalancers", "elasticloadbalancingv2:describeRules", "elasticloadbalancingv2:describeSSLPolicies", "elasticloadbalancingv2:describeTags", "elasticloadbalancingv2:describeTargetGroupAttributes", "elasticloadbalancingv2:describeTargetGroups", "elasticloadbalancingv2:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEvents", "health:describeEventTypes", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listV2LoggingLevels", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:listChannels", "medialive:listInputs", "medialive:listInputSecurityGroups", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:listContainers", "mobiletargeting:getApnsChannel", "mobiletargeting:getApplicationSettings", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEndpoint", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeModel", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2019-02-06T18:06:11.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:listNamedQueries", "athena:listQueryExecutions", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplications", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeClassicLinkInstances", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:listClusters", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEvents", "health:describeEventTypes", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listV2LoggingLevels", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listOfferings", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:listContainers", "mobiletargeting:getApnsChannel", "mobiletargeting:getApplicationSettings", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEndpoint", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:headBucket", "s3:listAllMyBuckets", "s3:listBucketMultipartUploads", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeModel", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v8": { "createdDate": "2019-12-16T19:39:42.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listBucket", "s3:listAllMyBuckets", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v10": { "createdDate": "2020-04-29T18:42:38.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:getDataSourceSyncJobHistory", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v5": { "createdDate": "2019-07-23T22:01:08.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:listNamedQueries", "athena:listQueryExecutions", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "budgets:describeBudget", "budgets:describeBudgets", "budgets:describeNotificationsForBudget", "budgets:describeSubscribersForNotification", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplications", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeClassicLinkInstances", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEvents", "health:describeEventTypes", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:headBucket", "s3:listAllMyBuckets", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v6": { "createdDate": "2019-09-09T20:15:28.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:listNamedQueries", "athena:listQueryExecutions", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:headBucket", "s3:listAllMyBuckets", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v7": { "createdDate": "2019-10-17T21:49:13.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:headBucket", "s3:listAllMyBuckets", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getDocument", "ssm:getInventory", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getParameterHistory", "ssm:getParameters", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listInventoryEntries", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v11": { "createdDate": "2020-07-09T23:29:32.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:getDataSourceSyncJobHistory", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v9": { "createdDate": "2020-03-10T18:55:18.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeUpdate", "eks:listClusters", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConfiguration", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listVersionsByFunction", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceAccessDetails", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeCompilationJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listCompilationJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAutomationExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v13": { "createdDate": "2020-10-13T17:46:33.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:getDataSourceSyncJobHistory", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeDomain", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeProcessingJob", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listDomains", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listProcessingJobs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v12": { "createdDate": "2020-08-26T19:01:32.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelines", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:getDataSourceSyncJobHistory", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputSecurityGroup", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeDomain", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeProcessingJob", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listDomains", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listProcessingJobs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v14": { "createdDate": "2021-01-28T20:00:15.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationUtilization", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listPackages", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeploymentTargets", "codedeploy:listDeployments", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailViolations", "controltower:listGuardrailsForTarget", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeLocalGateways", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ec2:searchLocalGatewayRoutes", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeRule", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedEntities", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEvents", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:getDataSourceSyncJobHistory", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:listApplications", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplateVersions", "quicksight:listTemplates", "quicksight:listUserGroups", "quicksight:listUsers", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeDomain", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelPackage", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describeProcessingJob", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listDomains", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelPackages", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listProcessingJobs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v15": { "createdDate": "2021-03-23T17:45:15.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLifecycleHooks", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeLoadBalancers", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:getDashboard", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listPackages", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetDeployments", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeploymentTargets", "codedeploy:listDeployments", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "compute-optimizer:getEBSVolumeRecommendations", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorderStatus", "config:describeConfigurationRecorders", "config:describeDeliveryChannelStatus", "config:describeDeliveryChannels", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailViolations", "controltower:listGuardrailsForTarget", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceStatus", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeLocalGateways", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ec2:searchLocalGatewayRoutes", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitionVersions", "greengrass:listCoreDefinitions", "greengrass:listDeployments", "greengrass:listDeviceDefinitionVersions", "greengrass:listDeviceDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listGroupVersions", "greengrass:listGroups", "greengrass:listLoggerDefinitionVersions", "greengrass:listLoggerDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listSubscriptionDefinitionVersions", "greengrass:listSubscriptionDefinitions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getIPSet", "guardduty:getInvitationsCount", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listInvitations", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventTypes", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThingTypes", "iot:listThings", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModelVersions", "iotevents:listDetectorModels", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBotVersions", "lex:getBots", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntentVersions", "lex:getIntents", "lex:getSlotType", "lex:getSlotTypeVersions", "lex:getSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getInstances", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobTemplates", "mediaconvert:listJobs", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputSecurityGroups", "medialive:listInputs", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStackSummary", "opsworks:describeStacks", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutionVersions", "personalize:listSolutions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplateVersions", "quicksight:listTemplates", "quicksight:listUserGroups", "quicksight:listUsers", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecretVersionIds", "secretsmanager:listSecrets", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v16": { "createdDate": "2021-07-01T21:52:12.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeFlow", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ec2:searchLocalGatewayRoutes", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeRepositories", "ecr:getRepositoryPolicy", "ecr:listImages", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listMetricSets", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-data:describeStatement", "redshift-data:listStatements", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v21": { "createdDate": "2022-02-18T00:53:34.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v23": { "createdDate": "2022-04-27T22:37:55.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listTagsForResource", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v22": { "createdDate": "2022-03-14T20:39:03.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listTagsForResource", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v19": { "createdDate": "2021-11-12T00:01:03.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeFlow", "appflow:listFlows", "appflow:describeConnectors", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v20": { "createdDate": "2021-12-21T23:48:04.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconnect:listTagsForResource", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getJobTagging", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObject", "s3:getObjectLegalHold", "s3:getObjectTagging", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:getStorageLensConfigurationTagging", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v24": { "createdDate": "2022-06-24T16:27:09.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:listChannels", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listTagsForResource", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v26": { "createdDate": "2022-10-04T21:30:02.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:listChannels", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listTagsForResource", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v17": { "createdDate": "2021-09-16T21:02:10.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeFlow", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:acceptReservedInstancesExchangeQuote", "ec2:cancelReservedInstancesListing", "ec2:createReservedInstancesListing", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:modifyReservedInstances", "ec2:purchaseReservedInstancesOffering", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v18": { "createdDate": "2021-10-06T19:23:26.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeFlow", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndPoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:adminGetUser", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUser", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:getResourceConfigHistory", "config:listDiscoveredResources", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayAttachmentPropagations", "ec2:getTransitGatewayRouteTableAssociations", "ec2:getTransitGatewayRouteTablePropagations", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "es:listTags", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:listTagsForResource", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "importexport:getStatus", "importexport:listJobs", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "kafka:describeCluster", "kafka:getBootstrapBrokers", "kafka:listClusters", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:listStreams", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeSubscriptionFilters", "logs:testMetricFilter", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:describeObject", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediastore:listItems", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getSites", "networkmanager:getTransitGatewayRegistrations", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTagsForResource", "route53:listTagsForResources", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:getAccelerateConfiguration", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketPolicy", "s3:getBucketRequestPayment", "s3:getBucketTagging", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getReplicationConfiguration", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:labelParameterVersion", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeServer", "transfer:describeUser", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "worklink:describeAuditStreamConfiguration", "worklink:describeCompanyNetworkConfiguration", "worklink:describeDevice", "worklink:describeDevicePolicyConfiguration", "worklink:describeDomain", "worklink:describeFleetMetadata", "worklink:describeIdentityProviderConfiguration", "worklink:describeWebsiteCertificateAuthority", "worklink:listDevices", "worklink:listDomains", "worklink:listFleets", "worklink:listWebsiteAuthorizationProviders", "worklink:listWebsiteCertificateAuthorities", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v27": { "createdDate": "2023-01-10T18:39:33.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v28": { "createdDate": "2023-03-16T20:29:42.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v25": { "createdDate": "2022-08-17T20:08:17.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getWorkGroup", "athena:listNamedQueries", "athena:listQueryExecutions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:searchLocalGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryTasks", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:listChannels", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listTagsForResource", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeRecipe", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:listCampaigns", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v30": { "createdDate": "2023-06-27T21:49:38.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v29": { "createdDate": "2023-05-02T23:33:56.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "a4b:getDevice", "a4b:getProfile", "a4b:getRoom", "a4b:getRoomSkillParameter", "a4b:getSkillGroup", "a4b:searchDevices", "a4b:searchProfiles", "a4b:searchRooms", "a4b:searchSkillGroups", "access-analyzer:getFinding", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getQueryExecution", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointTypes", "dms:describeOrderableReplicationInstances", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeGlobalTable", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listGlobalTables", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:describeImages", "ecr:describeImageScanFindings", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getRegistryPolicy", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeSnapshots", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:listDomainNames", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeRule", "events:listApiDestinations", "events:listConnections", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetPartition", "glue:checkSchemaVersionValidity", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getLogDelivery", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeGroup", "quicksight:describeIAMPolicyAssignment", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeUser", "quicksight:listDashboards", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listUserGroups", "quicksight:listUsers", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResponsePlan", "ssm-incidents:listIncidentRecords", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeExecution", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listExecutions", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v31": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*" ] }, { "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listDistributions", "cloudfront:listDistributionsByWebACLId", "cloudfront:listInvalidations", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeEventTopics", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitions", "glue:getRegistry", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:listAssets", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getChange", "route53:getCheckerIpRanges", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getDedicatedIp", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listTagsForResource", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeStateMachine", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listStateMachines", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getIPSet", "waf-regional:getRule", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listByteMatchSets", "waf-regional:listIPSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getIPSet", "waf:getRule", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listByteMatchSets", "waf:listIPSets", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v32": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listTagsForResource", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getType", "appsync:listDataSources", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listTypes", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describePhoneNumber", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listPhoneNumbersV2", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeInterconnects", "directconnect:describeLocations", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeElasticGpus", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "gamesparks:getExtension", "gamesparks:getExtensionVersion", "gamesparks:getGame", "gamesparks:getSnapshot", "gamesparks:getStage", "gamesparks:getStageDeployment", "gamesparks:listExtensions", "gamesparks:listExtensionVersions", "gamesparks:listGames", "gamesparks:listSnapshots", "gamesparks:listStageDeployments", "gamesparks:listStages", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkteam", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v33": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetSchema", "cleanrooms:getCollaboration", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAddons", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v34": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:getBootstrapBrokers", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClusterOperations", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v35": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeScraper", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listScrapers", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogAnomalyDetector", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listAnomalies", "logs:listLogAnomalyDetectors", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "networkmonitor:getMonitor", "networkmonitor:getProbe", "networkmonitor:listMonitors", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v36": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeScraper", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listScrapers", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getRestoreJobMetadata", "backup:getRestoreTestingInferredMetadata", "backup:getRestoreTestingPlan", "backup:getRestoreTestingSelection", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listRestoreJobsByProtectedResource", "backup:listRestoreTestingPlans", "backup:listRestoreTestingSelections", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetFleets", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listFleets", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZone", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listEnabledControls", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listLandingZones", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "cost-optimization-hub:getPreferences", "cost-optimization-hub:getRecommendation", "cost-optimization-hub:listEnrollmentStatuses", "cost-optimization-hub:listRecommendations", "cost-optimization-hub:listRecommendationSummaries", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "grafana:describeWorkspace", "grafana:describeWorkspaceAuthentication", "grafana:listPermissions", "grafana:listVersions", "grafana:listWorkspaces", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflow", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowBuildVersions", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflows", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCisScanConfigurations", "inspector2:listCisScanResultsAggregatedByChecks", "inspector2:listCisScanResultsAggregatedByTargetResource", "inspector2:listCisScans", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogAnomalyDetector", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listAnomalies", "logs:listLogAnomalyDetectors", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "networkmonitor:getMonitor", "networkmonitor:getProbe", "networkmonitor:listMonitors", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "qbusiness:getApplication", "qbusiness:getDataSource", "qbusiness:getIndex", "qbusiness:getRetriever", "qbusiness:getWebExperience", "qbusiness:listApplications", "qbusiness:listDataSources", "qbusiness:listDataSourceSyncJobs", "qbusiness:listIndices", "qbusiness:listRetrievers", "qbusiness:listWebExperiences", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:getBucketPolicy", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCluster", "sagemaker:describeClusterNode", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceComponent", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceComponents", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus", "xray:getEncryptionConfig", "xray:getGroup", "xray:getGroups", "xray:getSamplingRules", "xray:listResourcePolicies" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v37": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "account:getRegionOptStatus", "account:listRegions", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeScraper", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listScrapers", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTrafficSources", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getRestoreJobMetadata", "backup:getRestoreTestingInferredMetadata", "backup:getRestoreTestingPlan", "backup:getRestoreTestingSelection", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listRestoreJobsByProtectedResource", "backup:listRestoreTestingPlans", "backup:listRestoreTestingSelections", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "bedrock:getAgent", "bedrock:getAgentActionGroup", "bedrock:getAgentAlias", "bedrock:getAgentKnowledgeBase", "bedrock:getAgentVersion", "bedrock:getCustomModel", "bedrock:getDataSource", "bedrock:getIngestionJob", "bedrock:getKnowledgeBase", "bedrock:getModelCustomizationJob", "bedrock:getModelInvocationLoggingConfiguration", "bedrock:listAgentActionGroups", "bedrock:listAgentAliases", "bedrock:listAgentKnowledgeBases", "bedrock:listAgents", "bedrock:listAgentVersions", "bedrock:listCustomModels", "bedrock:listDataSources", "bedrock:listIngestionJobs", "bedrock:listKnowledgeBases", "bedrock:listModelCustomizationJobs", "bedrock:listProvisionedModelThroughputs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetFleets", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listFleets", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codeconnections:getConnection", "codeconnections:getHost", "codeconnections:getRepositoryLink", "codeconnections:getRepositorySyncStatus", "codeconnections:getResourceSyncStatus", "codeconnections:getSyncBlockerSummary", "codeconnections:getSyncConfiguration", "codeconnections:listConnections", "codeconnections:listHosts", "codeconnections:listRepositoryLinks", "codeconnections:listRepositorySyncDefinitions", "codeconnections:listSyncConfigurations", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZone", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listEnabledControls", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listLandingZones", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "cost-optimization-hub:getPreferences", "cost-optimization-hub:getRecommendation", "cost-optimization-hub:listEnrollmentStatuses", "cost-optimization-hub:listRecommendations", "cost-optimization-hub:listRecommendationSummaries", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "deadline:listAvailableMeteredProducts", "deadline:listBudgets", "deadline:listFarmMembers", "deadline:listFarms", "deadline:listFleetMembers", "deadline:listFleets", "deadline:listJobMembers", "deadline:listJobs", "deadline:listLicenseEndpoints", "deadline:listMeteredProducts", "deadline:listMonitors", "deadline:listQueueEnvironments", "deadline:listQueueFleetAssociations", "deadline:listQueueMembers", "deadline:listQueues", "deadline:listStorageProfiles", "deadline:listWorkers", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSnapshotTierStatus", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getSubnetCidrReservations", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describePodIdentityAssociation", "eks:listPodIdentityAssociations", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeTrustStores", "elasticloadbalancing:describeTrustStoreAssociations", "elasticloadbalancing:describeTrustStoreRevocations", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "freetier:getFreeTierUsage", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "grafana:describeWorkspace", "grafana:describeWorkspaceAuthentication", "grafana:listPermissions", "grafana:listVersions", "grafana:listWorkspaces", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflow", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowBuildVersions", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflows", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getConfiguration", "inspector2:getEc2DeepInspectionConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCisScanConfigurations", "inspector2:listCisScanResultsAggregatedByChecks", "inspector2:listCisScanResultsAggregatedByTargetResource", "inspector2:listCisScans", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogAnomalyDetector", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listAnomalies", "logs:listLogAnomalyDetectors", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "networkmonitor:getMonitor", "networkmonitor:getProbe", "networkmonitor:listMonitors", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "osis:getPipeline", "osis:getPipelineBlueprint", "osis:getPipelineChangeProgress", "osis:listPipelineBlueprints", "osis:listPipelines", "osis:validatePipeline", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "qbusiness:getApplication", "qbusiness:getDataSource", "qbusiness:getIndex", "qbusiness:getRetriever", "qbusiness:getWebExperience", "qbusiness:listApplications", "qbusiness:listDataSources", "qbusiness:listDataSourceSyncJobs", "qbusiness:listIndices", "qbusiness:listRetrievers", "qbusiness:listWebExperiences", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:getBucketPolicy", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCluster", "sagemaker:describeClusterNode", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceComponent", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceComponents", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeApplicationAssociations", "workspaces:describeWorkspaceAssociations", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus", "xray:getEncryptionConfig", "xray:getGroup", "xray:getGroups", "xray:getSamplingRules", "xray:listResourcePolicies", "xray:getInsightImpactGraph", "xray:getSamplingStatisticSummaries", "xray:getSamplingTargets", "xray:getServiceGraph", "xray:getTimeSeriesServiceStatistics", "xray:getTraceGraph" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v38": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "account:getRegionOptStatus", "account:listRegions", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "aoss:batchGetCollection", "aoss:batchGetEffectiveLifecyclePolicy", "aoss:batchGetLifecyclePolicy", "aoss:batchGetVpcEndpoint", "aoss:getAccessPolicy", "aoss:getAccountSettings", "aoss:getPoliciesStats", "aoss:getSecurityConfig", "aoss:getSecurityPolicy", "aoss:listAccessPolicies", "aoss:listCollections", "aoss:listLifecyclePolicies", "aoss:listSecurityConfigs", "aoss:listSecurityPolicies", "aoss:listTagsForResource", "aoss:listVpcEndpoints", "appconfig:getApplication", "appconfig:getConfigurationProfile", "appconfig:getDeployment", "appconfig:getDeploymentStrategy", "appconfig:getEnvironment", "appconfig:getExtension", "appconfig:getExtensionAssociation", "appconfig:listApplications", "appconfig:listConfigurationProfiles", "appconfig:listDeployments", "appconfig:listDeploymentStrategies", "appconfig:listEnvironments", "appconfig:listExtensionAssociations", "appconfig:listHostedConfigurationVersions", "appconfig:listExtensions", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "application-signals:getServiceLevelObjective", "application-signals:getService", "application-signals:listServiceDependencies", "application-signals:listServiceDependents", "application-signals:listServiceLevelObjectives", "application-signals:listServiceOperations", "application-signals:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeScraper", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listScrapers", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "athena:getCapacityAssignmentConfiguration", "athena:getCapacityReservation", "athena:listCapacityReservations", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTrafficSources", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getRestoreJobMetadata", "backup:getRestoreTestingInferredMetadata", "backup:getRestoreTestingPlan", "backup:getRestoreTestingSelection", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listRestoreJobsByProtectedResource", "backup:listRestoreTestingPlans", "backup:listRestoreTestingSelections", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "bedrock:getAgent", "bedrock:getAgentActionGroup", "bedrock:getAgentAlias", "bedrock:getAgentKnowledgeBase", "bedrock:getAgentVersion", "bedrock:getCustomModel", "bedrock:getDataSource", "bedrock:getIngestionJob", "bedrock:getKnowledgeBase", "bedrock:getModelCustomizationJob", "bedrock:getModelInvocationLoggingConfiguration", "bedrock:listAgentActionGroups", "bedrock:listAgentAliases", "bedrock:listAgentKnowledgeBases", "bedrock:listAgents", "bedrock:listAgentVersions", "bedrock:listCustomModels", "bedrock:listDataSources", "bedrock:listIngestionJobs", "bedrock:listKnowledgeBases", "bedrock:listModelCustomizationJobs", "bedrock:listProvisionedModelThroughputs", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudWatch:getMetricWidgetImage", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetFleets", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listFleets", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codeconnections:getConnection", "codeconnections:getHost", "codeconnections:getRepositoryLink", "codeconnections:getRepositorySyncStatus", "codeconnections:getResourceSyncStatus", "codeconnections:getSyncBlockerSummary", "codeconnections:getSyncConfiguration", "codeconnections:listConnections", "codeconnections:listHosts", "codeconnections:listRepositoryLinks", "codeconnections:listRepositorySyncDefinitions", "codeconnections:listSyncConfigurations", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZone", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listEnabledControls", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listLandingZones", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "cost-optimization-hub:getPreferences", "cost-optimization-hub:getRecommendation", "cost-optimization-hub:listEnrollmentStatuses", "cost-optimization-hub:listRecommendations", "cost-optimization-hub:listRecommendationSummaries", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "deadline:listAvailableMeteredProducts", "deadline:listBudgets", "deadline:listFarmMembers", "deadline:listFarms", "deadline:listFleetMembers", "deadline:listFleets", "deadline:listJobMembers", "deadline:listJobs", "deadline:listLicenseEndpoints", "deadline:listMeteredProducts", "deadline:listMonitors", "deadline:listQueueEnvironments", "deadline:listQueueFleetAssociations", "deadline:listQueueMembers", "deadline:listQueues", "deadline:listStorageProfiles", "deadline:listWorkers", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:getResourcePolicy", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSnapshotTierStatus", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getSubnetCidrReservations", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ec2:describeIpamByoasn", "ec2:describeIpamPools", "ec2:describeIpamResourceDiscoveries", "ec2:describeIpamResourceDiscoveryAssociations", "ec2:describeIpams", "ec2:describeIpamScopes", "ec2:getIpamAddressHistory", "ec2:getIpamDiscoveredAccounts", "ec2:getIpamDiscoveredPublicAddresses", "ec2:getIpamDiscoveredResourceCidrs", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describePodIdentityAssociation", "eks:listPodIdentityAssociations", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeBackupPolicy", "elasticfilesystem:describeReplicationConfigurations", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeTrustStores", "elasticloadbalancing:describeTrustStoreAssociations", "elasticloadbalancing:describeTrustStoreRevocations", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "freetier:getFreeTierUsage", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "grafana:describeWorkspace", "grafana:describeWorkspaceAuthentication", "grafana:listPermissions", "grafana:listVersions", "grafana:listWorkspaces", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflow", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowBuildVersions", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflows", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getConfiguration", "inspector2:getEc2DeepInspectionConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCisScanConfigurations", "inspector2:listCisScanResultsAggregatedByChecks", "inspector2:listCisScanResultsAggregatedByTargetResource", "inspector2:listCisScans", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listNamedShadowsForThing", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iot:listNamedShadowsForThing", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listTags", "lambda:listVersionsByFunction", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "launchwizard:listDeployments", "launchwizard:listDeploymentEvents", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogAnomalyDetector", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listAnomalies", "logs:listLogAnomalyDetectors", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "networkmonitor:getMonitor", "networkmonitor:getProbe", "networkmonitor:listMonitors", "nimble:getEula", "nimble:getLaunchProfile", "nimble:getLaunchProfileDetails", "nimble:getLaunchProfileInitialization", "nimble:getLaunchProfileMember", "nimble:getStreamingImage", "nimble:getStreamingSession", "nimble:getStreamingSessionStream", "nimble:getStudio", "nimble:getStudioComponent", "nimble:listEulaAcceptances", "nimble:listEulas", "nimble:listLaunchProfiles", "nimble:listStreamingImages", "nimble:listStreamingSessions", "nimble:listStudioComponents", "nimble:listStudios", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "osis:getPipeline", "osis:getPipelineBlueprint", "osis:getPipelineChangeProgress", "osis:listPipelineBlueprints", "osis:listPipelines", "osis:validatePipeline", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "qbusiness:getApplication", "qbusiness:getDataSource", "qbusiness:getIndex", "qbusiness:getRetriever", "qbusiness:getWebExperience", "qbusiness:listApplications", "qbusiness:listDataSources", "qbusiness:listDataSourceSyncJobs", "qbusiness:listIndices", "qbusiness:listRetrievers", "qbusiness:listWebExperiences", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53profiles:getProfile", "route53profiles:listProfileAssociations", "route53profiles:listProfileResourceAssociations", "route53profiles:listProfiles", "route53profiles:listTagsForResource", "route53profiles:getProfileResourceAssociation", "route53profiles:getProfileAssociation", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:getBucketPolicy", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCluster", "sagemaker:describeClusterNode", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceComponent", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceComponents", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securityhub:describeOrganizationConfiguration", "securityhub:batchGetConfigurationPolicyAssociations", "securityhub:getConfigurationPolicy", "securityhub:getConfigurationPolicyAssociation", "securityhub:listConfigurationPolicies", "securityhub:listConfigurationPolicyAssociations", "securityhub:getFindingAggregator", "securityhub:listFindingAggregators", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeApplicationAssociations", "workspaces:describeWorkspaceAssociations", "workspaces:describeWorkspacesPools", "workspaces:describeWorkspacesPoolSessions", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus", "xray:getEncryptionConfig", "xray:getGroup", "xray:getGroups", "xray:getSamplingRules", "xray:listResourcePolicies", "xray:getInsightImpactGraph", "xray:getSamplingStatisticSummaries", "xray:getSamplingTargets", "xray:getServiceGraph", "xray:getTimeSeriesServiceStatistics", "xray:getTraceGraph" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } }, "v39": { "createdDate": "2018-04-19T18:04:44.000Z", "document": { "Statement": [ { "Sid": "AWSSupportAPIGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "AWSSupportDeleteRoleAccess", "Action": [ "iam:DeleteRole" ], "Effect": "Allow", "Resource": [ "arn:aws:iam::*:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport" ] }, { "Sid": "AWSSupportActions", "Action": [ "access-analyzer:getAccessPreview", "access-analyzer:getAnalyzedResource", "access-analyzer:getAnalyzer", "access-analyzer:getArchiveRule", "access-analyzer:getFinding", "access-analyzer:getGeneratedPolicy", "access-analyzer:listAccessPreviewFindings", "access-analyzer:listAccessPreviews", "access-analyzer:listAnalyzedResources", "access-analyzer:listAnalyzers", "access-analyzer:listArchiveRules", "access-analyzer:listFindings", "access-analyzer:listPolicyGenerations", "account:getRegionOptStatus", "account:listRegions", "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "airflow:getEnvironment", "airflow:listEnvironments", "airflow:listTagsForResource", "amplify:getApp", "amplify:getBackendEnvironment", "amplify:getBranch", "amplify:getDomainAssociation", "amplify:getJob", "amplify:getWebhook", "amplify:listApps", "amplify:listBackendEnvironments", "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", "aoss:batchGetCollection", "aoss:batchGetEffectiveLifecyclePolicy", "aoss:batchGetLifecyclePolicy", "aoss:batchGetVpcEndpoint", "aoss:getAccessPolicy", "aoss:getAccountSettings", "aoss:getPoliciesStats", "aoss:getSecurityConfig", "aoss:getSecurityPolicy", "aoss:listAccessPolicies", "aoss:listCollections", "aoss:listLifecyclePolicies", "aoss:listSecurityConfigs", "aoss:listSecurityPolicies", "aoss:listTagsForResource", "aoss:listVpcEndpoints", "appconfig:getApplication", "appconfig:getConfigurationProfile", "appconfig:getDeployment", "appconfig:getDeploymentStrategy", "appconfig:getEnvironment", "appconfig:getExtension", "appconfig:getExtensionAssociation", "appconfig:listApplications", "appconfig:listConfigurationProfiles", "appconfig:listDeployments", "appconfig:listDeploymentStrategies", "appconfig:listEnvironments", "appconfig:listExtensionAssociations", "appconfig:listHostedConfigurationVersions", "appconfig:listExtensions", "appflow:describeConnectorEntity", "appflow:describeConnectorProfiles", "appflow:describeConnectors", "appflow:describeFlow", "appflow:describeFlowExecutionRecords", "appflow:listConnectorEntities", "appflow:listFlows", "application-autoscaling:describeScalableTargets", "application-autoscaling:describeScalingActivities", "application-autoscaling:describeScalingPolicies", "application-autoscaling:describeScheduledActions", "applicationinsights:describeApplication", "applicationinsights:describeComponent", "applicationinsights:describeComponentConfiguration", "applicationinsights:describeComponentConfigurationRecommendation", "applicationinsights:describeLogPattern", "applicationinsights:describeObservation", "applicationinsights:describeProblem", "applicationinsights:describeProblemObservations", "applicationinsights:listApplications", "applicationinsights:listComponents", "applicationinsights:listConfigurationHistory", "applicationinsights:listLogPatterns", "applicationinsights:listLogPatternSets", "applicationinsights:listProblems", "appmesh:describeGatewayRoute", "appmesh:describeMesh", "appmesh:describeRoute", "appmesh:describeVirtualGateway", "appmesh:describeVirtualNode", "appmesh:describeVirtualRouter", "appmesh:describeVirtualService", "appmesh:listGatewayRoutes", "appmesh:listMeshes", "appmesh:listRoutes", "appmesh:listTagsForResource", "appmesh:listVirtualGateways", "appmesh:listVirtualNodes", "appmesh:listVirtualRouters", "appmesh:listVirtualServices", "apprunner:describeAutoScalingConfiguration", "apprunner:describeCustomDomains", "apprunner:describeOperation", "apprunner:describeService", "apprunner:listAutoScalingConfigurations", "apprunner:listConnections", "apprunner:listOperations", "apprunner:listServices", "application-signals:getServiceLevelObjective", "application-signals:getService", "application-signals:listServiceDependencies", "application-signals:listServiceDependents", "application-signals:listServiceLevelObjectives", "application-signals:listServiceOperations", "application-signals:listServices", "apprunner:listTagsForResource", "appstream:describeAppBlockBuilderAppBlockAssociations", "appstream:describeAppBlockBuilders", "appstream:describeAppBlocks", "appstream:describeApplicationFleetAssociations", "appstream:describeApplications", "appstream:describeDirectoryConfigs", "appstream:describeEntitlements", "appstream:describeFleets", "appstream:describeImageBuilders", "appstream:describeImagePermissions", "appstream:describeImages", "appstream:describeSessions", "appstream:describeStacks", "appstream:describeUsageReportSubscriptions", "appstream:describeUsers", "appstream:describeUserStackAssociations", "appstream:listAssociatedFleets", "appstream:listAssociatedStacks", "appstream:listEntitledApplications", "appstream:listTagsForResource", "appsync:getApiAssociation", "appsync:getApiCache", "appsync:getDomainName", "appsync:getFunction", "appsync:getGraphqlApi", "appsync:getIntrospectionSchema", "appsync:getResolver", "appsync:getSchemaCreationStatus", "appsync:getSourceApiAssociation", "appsync:getType", "appsync:listDataSources", "appsync:listDomainNames", "appsync:listFunctions", "appsync:listGraphqlApis", "appsync:listResolvers", "appsync:listResolversByFunction", "appsync:listSourceApiAssociations", "appsync:listTypes", "appsync:listTypesByAssociation", "aps:describeAlertManagerDefinition", "aps:describeRuleGroupsNamespace", "aps:describeScraper", "aps:describeWorkspace", "aps:listRuleGroupsNamespaces", "aps:listScrapers", "aps:listWorkspaces", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "athena:getCapacityAssignmentConfiguration", "athena:getCapacityReservation", "athena:listCapacityReservations", "auditmanager:getAccountStatus", "auditmanager:getDelegations", "auditmanager:listAssessmentFrameworks", "auditmanager:listAssessmentReports", "auditmanager:listAssessments", "auditmanager:listControls", "auditmanager:listKeywordsForDataSource", "auditmanager:listNotifications", "autoscaling-plans:describeScalingPlanResources", "autoscaling-plans:describeScalingPlans", "autoscaling-plans:getScalingPlanResourceForecastData", "autoscaling:describeAccountLimits", "autoscaling:describeAdjustmentTypes", "autoscaling:describeAutoScalingGroups", "autoscaling:describeAutoScalingInstances", "autoscaling:describeAutoScalingNotificationTypes", "autoscaling:describeInstanceRefreshes", "autoscaling:describeLaunchConfigurations", "autoscaling:describeLifecycleHooks", "autoscaling:describeLifecycleHookTypes", "autoscaling:describeLoadBalancers", "autoscaling:describeLoadBalancerTargetGroups", "autoscaling:describeMetricCollectionTypes", "autoscaling:describeNotificationConfigurations", "autoscaling:describePolicies", "autoscaling:describeScalingActivities", "autoscaling:describeScalingProcessTypes", "autoscaling:describeScheduledActions", "autoscaling:describeTrafficSources", "autoscaling:describeTags", "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeWarmPool", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getRestoreJobMetadata", "backup:getRestoreTestingInferredMetadata", "backup:getRestoreTestingPlan", "backup:getRestoreTestingSelection", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlans", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listRestoreJobsByProtectedResource", "backup:listRestoreTestingPlans", "backup:listRestoreTestingSelections", "backup:listTags", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "batch:describeComputeEnvironments", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:listJobs", "bedrock:getAgent", "bedrock:getAgentActionGroup", "bedrock:getAgentAlias", "bedrock:getAgentKnowledgeBase", "bedrock:getAgentVersion", "bedrock:getDataSource", "bedrock:getIngestionJob", "bedrock:getKnowledgeBase", "bedrock:getModelInvocationLoggingConfiguration", "bedrock:listAgentActionGroups", "bedrock:listAgentAliases", "bedrock:listAgentKnowledgeBases", "bedrock:listAgents", "bedrock:listAgentVersions", "bedrock:listCustomModels", "bedrock:listDataSources", "bedrock:listIngestionJobs", "bedrock:listKnowledgeBases", "bedrock:listProvisionedModelThroughputs", "bedrock:getEvaluationJob", "bedrock:getFoundationModel", "bedrock:getCustomModel", "bedrock:getGuardrail", "bedrock:getImportedModel", "bedrock:getInferenceProfile", "bedrock:getModelCopyJob", "bedrock:getModelCustomizationJob", "bedrock:getModelImportJob", "bedrock:getModelInvocationJob", "bedrock:getProvisionedModelThroughput", "bedrock:listEvaluationJobs", "bedrock:listFoundationModels", "bedrock:listGuardrails", "bedrock:listInferenceProfiles", "bedrock:listImportedModels", "bedrock:listModelCopyJobs", "bedrock:listModelCustomizationJobs", "bedrock:listModelImportJobs", "bedrock:listModelInvocationJobs", "bedrock:getFlow", "bedrock:getFlowAlias", "bedrock:getFlowVersion", "bedrock:getPrompt", "bedrock:listFlowAliases", "bedrock:listFlowVersions", "bedrock:listFlows", "bedrock:listPrompts", "braket:getDevice", "braket:getQuantumTask", "braket:searchDevices", "braket:searchQuantumTasks", "budgets:viewBudget", "ce:getCostAndUsage", "ce:getCostAndUsageWithResources", "ce:getCostForecast", "ce:getDimensionValues", "ce:getReservationCoverage", "ce:getReservationPurchaseRecommendation", "ce:getReservationUtilization", "ce:getRightsizingRecommendation", "ce:getSavingsPlansCoverage", "ce:getSavingsPlansPurchaseRecommendation", "ce:getSavingsPlansUtilization", "ce:getSavingsPlansUtilizationDetails", "ce:getTags", "chime:describeAppInstance", "chime:getAttendee", "chime:getGlobalSettings", "chime:getMediaCapturePipeline", "chime:getMediaPipeline", "chime:getMeeting", "chime:getProxySession", "chime:getSipMediaApplication", "chime:getSipRule", "chime:getVoiceConnector", "chime:getVoiceConnectorGroup", "chime:getVoiceConnectorLoggingConfiguration", "chime:listAppInstances", "chime:listAttendees", "chime:listChannelBans", "chime:listChannels", "chime:listChannelsModeratedByAppInstanceUser", "chime:listMediaCapturePipelines", "chime:listMediaPipelines", "chime:listMeetings", "chime:listSipMediaApplications", "chime:listSipRules", "chime:listVoiceConnectorGroups", "chime:listVoiceConnectors", "cleanrooms:batchGetCollaborationAnalysisTemplate", "cleanrooms:batchGetSchema", "cleanrooms:getAnalysisTemplate", "cleanrooms:getCollaboration", "cleanrooms:getCollaborationAnalysisTemplate", "cleanrooms:getConfiguredTable", "cleanrooms:getConfiguredTableAssociation", "cleanrooms:getMembership", "cleanrooms:getSchema", "cleanrooms:listAnalysisTemplates", "cleanrooms:listCollaborationAnalysisTemplates", "cleanrooms:listCollaborations", "cleanrooms:listConfiguredTableAssociations", "cleanrooms:listConfiguredTables", "cleanrooms:listMembers", "cleanrooms:listMemberships", "cleanrooms:listSchemas", "cloud9:describeEnvironmentMemberships", "cloud9:describeEnvironments", "cloud9:listEnvironments", "clouddirectory:getDirectory", "clouddirectory:listDirectories", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStacks", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStacks", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", "cloudhsm:describeBackups", "cloudhsm:describeClusters", "cloudsearch:describeAnalysisSchemes", "cloudsearch:describeAvailabilityOptions", "cloudsearch:describeDomains", "cloudsearch:describeExpressions", "cloudsearch:describeIndexFields", "cloudsearch:describeScalingParameters", "cloudsearch:describeServiceAccessPolicies", "cloudsearch:describeSuggesters", "cloudsearch:listDomainNames", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudWatch:getMetricWidgetImage", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetrics", "cloudwatch:listMetricStreams", "codeartifact:describeDomain", "codeartifact:describePackageVersion", "codeartifact:describeRepository", "codeartifact:getDomainPermissionsPolicy", "codeartifact:getRepositoryEndpoint", "codeartifact:getRepositoryPermissionsPolicy", "codeartifact:listDomains", "codeartifact:listPackages", "codeartifact:listPackageVersionAssets", "codeartifact:listPackageVersions", "codeartifact:listRepositories", "codeartifact:listRepositoriesInDomain", "codebuild:batchGetBuildBatches", "codebuild:batchGetBuilds", "codebuild:batchGetFleets", "codebuild:batchGetProjects", "codebuild:listBuildBatches", "codebuild:listBuildBatchesForProject", "codebuild:listBuilds", "codebuild:listBuildsForProject", "codebuild:listCuratedEnvironmentImages", "codebuild:listFleets", "codebuild:listProjects", "codebuild:listSourceCredentials", "codecommit:batchGetRepositories", "codecommit:getBranch", "codecommit:getRepository", "codecommit:getRepositoryTriggers", "codecommit:listBranches", "codecommit:listRepositories", "codeconnections:getConnection", "codeconnections:getHost", "codeconnections:getRepositoryLink", "codeconnections:getRepositorySyncStatus", "codeconnections:getResourceSyncStatus", "codeconnections:getSyncBlockerSummary", "codeconnections:getSyncConfiguration", "codeconnections:listConnections", "codeconnections:listHosts", "codeconnections:listRepositoryLinks", "codeconnections:listRepositorySyncDefinitions", "codeconnections:listSyncConfigurations", "codedeploy:batchGetApplicationRevisions", "codedeploy:batchGetApplications", "codedeploy:batchGetDeploymentGroups", "codedeploy:batchGetDeploymentInstances", "codedeploy:batchGetDeployments", "codedeploy:batchGetDeploymentTargets", "codedeploy:batchGetOnPremisesInstances", "codedeploy:getApplication", "codedeploy:getApplicationRevision", "codedeploy:getDeployment", "codedeploy:getDeploymentConfig", "codedeploy:getDeploymentGroup", "codedeploy:getDeploymentInstance", "codedeploy:getDeploymentTarget", "codedeploy:getOnPremisesInstance", "codedeploy:listApplicationRevisions", "codedeploy:listApplications", "codedeploy:listDeploymentConfigs", "codedeploy:listDeploymentGroups", "codedeploy:listDeploymentInstances", "codedeploy:listDeployments", "codedeploy:listDeploymentTargets", "codedeploy:listGitHubAccountTokenNames", "codedeploy:listOnPremisesInstances", "codepipeline:getJobDetails", "codepipeline:getPipeline", "codepipeline:getPipelineExecution", "codepipeline:getPipelineState", "codepipeline:listActionExecutions", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "codepipeline:listWebhooks", "codestar:describeProject", "codestar:listProjects", "codestar:listResources", "codestar:listTeamMembers", "codestar:listUserProfiles", "codestar-connections:getConnection", "codestar-connections:getHost", "codestar-connections:listConnections", "codestar-connections:listHosts", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "comprehend:describeDocumentClassificationJob", "comprehend:describeDocumentClassifier", "comprehend:describeDominantLanguageDetectionJob", "comprehend:describeEndpoint", "comprehend:describeEntitiesDetectionJob", "comprehend:describeEntityRecognizer", "comprehend:describeEventsDetectionJob", "comprehend:describeFlywheel", "comprehend:describeFlywheelIteration", "comprehend:describeKeyPhrasesDetectionJob", "comprehend:describePiiEntitiesDetectionJob", "comprehend:describeSentimentDetectionJob", "comprehend:describeTargetedSentimentDetectionJob", "comprehend:describeTopicsDetectionJob", "comprehend:listDocumentClassificationJobs", "comprehend:listDocumentClassifiers", "comprehend:listDominantLanguageDetectionJobs", "comprehend:listEndpoints", "comprehend:listEntitiesDetectionJobs", "comprehend:listEntityRecognizers", "comprehend:listEventsDetectionJobs", "comprehend:listFlywheelIterationHistory", "comprehend:listFlywheels", "comprehend:listKeyPhrasesDetectionJobs", "comprehend:listPiiEntitiesDetectionJobs", "comprehend:listSentimentDetectionJobs", "comprehend:listTargetedSentimentDetectionJobs", "comprehend:listTopicsDetectionJobs", "compute-optimizer:getAutoScalingGroupRecommendations", "compute-optimizer:getEBSVolumeRecommendations", "compute-optimizer:getEC2InstanceRecommendations", "compute-optimizer:getEC2RecommendationProjectedMetrics", "compute-optimizer:getECSServiceRecommendations", "compute-optimizer:getECSServiceRecommendationProjectedMetrics", "compute-optimizer:getEnrollmentStatus", "compute-optimizer:getRecommendationSummaries", "config:batchGetAggregateResourceConfig", "config:batchGetResourceConfig", "config:describeAggregateComplianceByConfigRules", "config:describeAggregationAuthorizations", "config:describeComplianceByConfigRule", "config:describeComplianceByResource", "config:describeConfigRuleEvaluationStatus", "config:describeConfigRules", "config:describeConfigurationAggregators", "config:describeConfigurationAggregatorSourcesStatus", "config:describeConfigurationRecorders", "config:describeConfigurationRecorderStatus", "config:describeConformancePackCompliance", "config:describeConformancePacks", "config:describeConformancePackStatus", "config:describeDeliveryChannels", "config:describeDeliveryChannelStatus", "config:describeOrganizationConfigRules", "config:describeOrganizationConfigRuleStatuses", "config:describeOrganizationConformancePacks", "config:describeOrganizationConformancePackStatuses", "config:describePendingAggregationRequests", "config:describeRemediationConfigurations", "config:describeRemediationExceptions", "config:describeRemediationExecutionStatus", "config:describeRetentionConfigurations", "config:getAggregateComplianceDetailsByConfigRule", "config:getAggregateConfigRuleComplianceSummary", "config:getAggregateDiscoveredResourceCounts", "config:getAggregateResourceConfig", "config:getComplianceDetailsByConfigRule", "config:getComplianceDetailsByResource", "config:getComplianceSummaryByConfigRule", "config:getComplianceSummaryByResourceType", "config:getConformancePackComplianceDetails", "config:getConformancePackComplianceSummary", "config:getDiscoveredResourceCounts", "config:getOrganizationConfigRuleDetailedStatus", "config:getOrganizationConformancePackDetailedStatus", "config:getResourceConfigHistory", "config:listAggregateDiscoveredResources", "config:listDiscoveredResources", "config:listTagsForResource", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationForms", "connect:listEvaluationFormVersions", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViews", "connect:listViewVersions", "connect:describeQueue", "connect:listQueues", "connect:describeRoutingProfile", "connect:searchQueues", "connect:searchUsers", "connect:searchRoutingProfiles", "connect:listRoutingProfileQueues", "connect:describeUserHierarchyStructure", "connect:listQueueQuickConnects", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", "controltower:describeGuardrailForTarget", "controltower:describeManagedAccount", "controltower:describeSingleSignOn", "controltower:getAvailableUpdates", "controltower:getHomeRegion", "controltower:getLandingZone", "controltower:getLandingZoneStatus", "controltower:listDirectoryGroups", "controltower:listEnabledControls", "controltower:listGuardrailsForTarget", "controltower:listGuardrailViolations", "controltower:listLandingZones", "controltower:listManagedAccounts", "controltower:listManagedAccountsForGuardrail", "controltower:listManagedAccountsForParent", "controltower:listManagedOrganizationalUnits", "controltower:listManagedOrganizationalUnitsForGuardrail", "cost-optimization-hub:getPreferences", "cost-optimization-hub:getRecommendation", "cost-optimization-hub:listEnrollmentStatuses", "cost-optimization-hub:listRecommendations", "cost-optimization-hub:listRecommendationSummaries", "databrew:describeDataset", "databrew:describeJob", "databrew:describeProject", "databrew:describeRecipe", "databrew:listDatasets", "databrew:listJobRuns", "databrew:listJobs", "databrew:listProjects", "databrew:listRecipes", "databrew:listRecipeVersions", "databrew:listTagsForResource", "datapipeline:describeObjects", "datapipeline:describePipelines", "datapipeline:getPipelineDefinition", "datapipeline:listPipelines", "datapipeline:queryObjects", "datasync:describeAgent", "datasync:describeLocationEfs", "datasync:describeLocationFsxLustre", "datasync:describeLocationFsxOpenZfs", "datasync:describeLocationFsxWindows", "datasync:describeLocationHdfs", "datasync:describeLocationNfs", "datasync:describeLocationObjectStorage", "datasync:describeLocationS3", "datasync:describeLocationSmb", "datasync:describeTask", "datasync:describeTaskExecution", "datasync:listAgents", "datasync:listLocations", "datasync:listTaskExecutions", "datasync:listTasks", "datazone:getAsset", "datazone:getAssetType", "datazone:getDataSource", "datazone:getDataSourceRun", "datazone:getDomain", "datazone:getEnvironment", "datazone:getEnvironmentBlueprint", "datazone:getEnvironmentBlueprintConfiguration", "datazone:getFormType", "datazone:getGlossary", "datazone:getGlossaryTerm", "datazone:getGroupProfile", "datazone:getListing", "datazone:getMetadataGenerationRun", "datazone:getProject", "datazone:getSubscription", "datazone:getSubscriptionGrant", "datazone:getSubscriptionRequestDetails", "datazone:getSubscriptionTarget", "datazone:getUserProfile", "datazone:listAssetRevisions", "datazone:listDataSourceRunActivities", "datazone:listDataSourceRuns", "datazone:listDataSources", "datazone:listDomains", "datazone:listEnvironmentBlueprintConfigurations", "datazone:listEnvironmentBlueprints", "datazone:listEnvironmentProfiles", "datazone:listEnvironments", "datazone:listMetadataGenerationRuns", "datazone:listProjectMemberships", "datazone:listProjects", "datazone:listSubscriptionGrants", "datazone:listSubscriptionRequests", "datazone:listSubscriptions", "datazone:listSubscriptionTargets", "datazone:searchGroupProfiles", "datazone:searchUserProfiles", "datazone:getEnvironmentProfile", "dax:describeClusters", "dax:describeDefaultParameters", "dax:describeEvents", "dax:describeParameterGroups", "dax:describeParameters", "dax:describeSubnetGroups", "deadline:listAvailableMeteredProducts", "deadline:listBudgets", "deadline:listFarmMembers", "deadline:listFarms", "deadline:listFleetMembers", "deadline:listFleets", "deadline:listJobMembers", "deadline:listJobs", "deadline:listLicenseEndpoints", "deadline:listMeteredProducts", "deadline:listMonitors", "deadline:listQueueEnvironments", "deadline:listQueueFleetAssociations", "deadline:listQueueMembers", "deadline:listQueues", "deadline:listStorageProfiles", "deadline:listWorkers", "detective:getMembers", "detective:listGraphs", "detective:listInvitations", "detective:listMembers", "devicefarm:getAccountSettings", "devicefarm:getDevice", "devicefarm:getDevicePool", "devicefarm:getDevicePoolCompatibility", "devicefarm:getJob", "devicefarm:getProject", "devicefarm:getRemoteAccessSession", "devicefarm:getRun", "devicefarm:getSuite", "devicefarm:getTest", "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", "devicefarm:listSamples", "devicefarm:listSuites", "devicefarm:listTestGridProjects", "devicefarm:listTestGridSessionActions", "devicefarm:listTestGridSessionArtifacts", "devicefarm:listTestGridSessions", "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dlm:getLifecyclePolicies", "dlm:getLifecyclePolicy", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpoints", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEventCategories", "dms:describeEvents", "dms:describeEventSubscriptions", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstances", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "docdb-elastic:getCluster", "docdb-elastic:getClusterSnapshot", "docdb-elastic:listClusters", "docdb-elastic:listClusterSnapshots", "drs:describeJobLogItems", "drs:describeJobs", "drs:describeLaunchConfigurationTemplates", "drs:describeRecoveryInstances", "drs:describeRecoverySnapshots", "drs:describeReplicationConfigurationTemplates", "drs:describeSourceNetworks", "drs:describeSourceServers", "drs:getLaunchConfiguration", "drs:getReplicationConfiguration", "drs:listExtensibleSourceServers", "drs:listLaunchActions", "drs:listStagingAccounts", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "dynamodb:describeBackup", "dynamodb:describeContinuousBackups", "dynamodb:describeContributorInsights", "dynamodb:describeExport", "dynamodb:describeGlobalTable", "dynamodb:describeImport", "dynamodb:describeKinesisStreamingDestination", "dynamodb:describeLimits", "dynamodb:describeStream", "dynamodb:describeTable", "dynamodb:describeTimeToLive", "dynamodb:getResourcePolicy", "dynamodb:listBackups", "dynamodb:listContributorInsights", "dynamodb:listExports", "dynamodb:listGlobalTables", "dynamodb:listImports", "dynamodb:listStreams", "dynamodb:listTables", "dynamodb:listTagsOfResource", "ec2:describeAccountAttributes", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAddressTransfers", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdentityIdFormat", "ec2:describeIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstances", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpamScopes", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplates", "ec2:describeLaunchTemplateVersions", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGateways", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describeNetworkInsightsPaths", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshots", "ec2:describeSnapshotTierStatus", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGateways", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVolumeStatus", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpoints", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getSubnetCidrReservations", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ec2:describeIpamByoasn", "ec2:describeIpamResourceDiscoveries", "ec2:describeIpamResourceDiscoveryAssociations", "ec2:describeIpams", "ec2:getIpamDiscoveredAccounts", "ec2:getIpamDiscoveredPublicAddresses", "ec2:getIpamDiscoveredResourceCidrs", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:describeNetworkInsightsAccessScopes", "ec2:describeNetworkInsightsAnalyses", "ec2:describeTrafficMirrorFilterRules", "ecr-public:describeImages", "ecr-public:describeImageTags", "ecr-public:describeRegistries", "ecr-public:describeRepositories", "ecr-public:getRegistryCatalogData", "ecr-public:getRepositoryCatalogData", "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImages", "ecr:describeImageReplicationStatus", "ecr:describeImageScanFindings", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", "ecr:listImages", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTasks", "ecs:describeTaskSets", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describePodIdentityAssociation", "eks:listPodIdentityAssociations", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listUpdates", "eks:describeInsight", "eks:listInsights", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCaches", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeBackupPolicy", "elasticfilesystem:describeReplicationConfigurations", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeTrustStores", "elasticloadbalancing:describeTrustStoreAssociations", "elasticloadbalancing:describeTrustStoreRevocations", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticmapreduce:describeCluster", "elasticmapreduce:describeNotebookExecution", "elasticmapreduce:describeReleaseLabel", "elasticmapreduce:describeSecurityConfiguration", "elasticmapreduce:describeStep", "elasticmapreduce:describeStudio", "elasticmapreduce:getAutoTerminationPolicy", "elasticmapreduce:getBlockPublicAccessConfiguration", "elasticmapreduce:getManagedScalingPolicy", "elasticmapreduce:getStudioSessionMapping", "elasticmapreduce:listBootstrapActions", "elasticmapreduce:listClusters", "elasticmapreduce:listInstanceFleets", "elasticmapreduce:listInstanceGroups", "elasticmapreduce:listInstances", "elasticmapreduce:listNotebookExecutions", "elasticmapreduce:listReleaseLabels", "elasticmapreduce:listSecurityConfigurations", "elasticmapreduce:listSteps", "elasticmapreduce:listStudios", "elasticmapreduce:listStudioSessionMappings", "elastictranscoder:listJobsByPipeline", "elastictranscoder:listJobsByStatus", "elastictranscoder:listPipelines", "elastictranscoder:listPresets", "elastictranscoder:readPipeline", "elastictranscoder:readPreset", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "evidently:getExperiment", "evidently:getFeature", "evidently:getLaunch", "evidently:getProject", "evidently:getSegment", "evidently:listExperiments", "evidently:listFeatures", "evidently:listLaunches", "evidently:listProjects", "evidently:listSegments", "evidently:listSegmentReferences", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listArchives", "events:listApiDestinations", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fms:getAdminAccount", "fms:getComplianceDetail", "fms:getNotificationChannel", "fms:getPolicy", "fms:getProtectionStatus", "fms:listComplianceStatus", "fms:listMemberAccounts", "fms:listPolicies", "forecast:describeDataset", "forecast:describeDatasetGroup", "forecast:describeDatasetImportJob", "forecast:describeForecast", "forecast:describeForecastExportJob", "forecast:describePredictor", "forecast:getAccuracyMetrics", "forecast:listDatasetGroups", "forecast:listDatasetImportJobs", "forecast:listDatasets", "forecast:listForecastExportJobs", "forecast:listForecasts", "forecast:listPredictors", "freetier:getFreeTierUsage", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "gamelift:describeAlias", "gamelift:describeBuild", "gamelift:describeEC2InstanceLimits", "gamelift:describeFleetAttributes", "gamelift:describeFleetCapacity", "gamelift:describeFleetEvents", "gamelift:describeFleetLocationAttributes", "gamelift:describeFleetLocationCapacity", "gamelift:describeFleetLocationUtilization", "gamelift:describeFleetPortSettings", "gamelift:describeFleetUtilization", "gamelift:describeGameServer", "gamelift:describeGameServerGroup", "gamelift:describeGameSessionDetails", "gamelift:describeGameSessionPlacement", "gamelift:describeGameSessionQueues", "gamelift:describeGameSessions", "gamelift:describeInstances", "gamelift:describeMatchmaking", "gamelift:describeMatchmakingConfigurations", "gamelift:describeMatchmakingRuleSets", "gamelift:describePlayerSessions", "gamelift:describeRuntimeConfiguration", "gamelift:describeScalingPolicies", "gamelift:describeScript", "gamelift:listAliases", "gamelift:listBuilds", "gamelift:listFleets", "gamelift:listGameServerGroups", "gamelift:listGameServers", "gamelift:listScripts", "gamelift:resolveAlias", "glacier:describeJob", "glacier:describeVault", "glacier:getDataRetrievalPolicy", "glacier:getVaultAccessPolicy", "glacier:getVaultLock", "glacier:getVaultNotifications", "glacier:listJobs", "glacier:listTagsForVault", "glacier:listVaults", "globalaccelerator:describeAccelerator", "globalaccelerator:describeAcceleratorAttributes", "globalaccelerator:describeEndpointGroup", "globalaccelerator:describeListener", "globalaccelerator:listAccelerators", "globalaccelerator:listEndpointGroups", "globalaccelerator:listListeners", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMapping", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTables", "glue:getTableVersions", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemas", "glue:listSchemaVersions", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "glue:listTableOptimizerRuns", "glue:getTableOptimizer", "grafana:describeWorkspace", "grafana:describeWorkspaceAuthentication", "grafana:listPermissions", "grafana:listVersions", "grafana:listWorkspaces", "greengrass:getConnectivityInfo", "greengrass:getCoreDefinition", "greengrass:getCoreDefinitionVersion", "greengrass:getDeploymentStatus", "greengrass:getDeviceDefinition", "greengrass:getDeviceDefinitionVersion", "greengrass:getFunctionDefinition", "greengrass:getFunctionDefinitionVersion", "greengrass:getGroup", "greengrass:getGroupCertificateAuthority", "greengrass:getGroupVersion", "greengrass:getLoggerDefinition", "greengrass:getLoggerDefinitionVersion", "greengrass:getResourceDefinitionVersion", "greengrass:getServiceRoleForAccount", "greengrass:getSubscriptionDefinition", "greengrass:getSubscriptionDefinitionVersion", "greengrass:listCoreDefinitions", "greengrass:listCoreDefinitionVersions", "greengrass:listDeployments", "greengrass:listDeviceDefinitions", "greengrass:listDeviceDefinitionVersions", "greengrass:listFunctionDefinitions", "greengrass:listFunctionDefinitionVersions", "greengrass:listGroups", "greengrass:listGroupVersions", "greengrass:listLoggerDefinitions", "greengrass:listLoggerDefinitionVersions", "greengrass:listResourceDefinitions", "greengrass:listResourceDefinitionVersions", "greengrass:listSubscriptionDefinitions", "greengrass:listSubscriptionDefinitionVersions", "guardduty:getDetector", "guardduty:getFindings", "guardduty:getFindingsStatistics", "guardduty:getInvitationsCount", "guardduty:getIPSet", "guardduty:getMasterAccount", "guardduty:getMembers", "guardduty:getThreatIntelSet", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listInvitations", "guardduty:listIPSets", "guardduty:listMembers", "guardduty:listThreatIntelSets", "health:describeAffectedAccountsForOrganization", "health:describeAffectedEntities", "health:describeAffectedEntitiesForOrganization", "health:describeEntityAggregates", "health:describeEntityAggregatesForOrganization", "health:describeEventAggregates", "health:describeEventDetails", "health:describeEventDetailsForOrganization", "health:describeEvents", "health:describeEventsForOrganization", "health:describeEventTypes", "health:describeHealthServiceStatusForOrganization", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getSSHPublicKey", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listSSHPublicKeys", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "iam:simulateCustomPolicy", "iam:simulatePrincipalPolicy", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", "imagebuilder:getDistributionConfiguration", "imagebuilder:getImage", "imagebuilder:getImagePipeline", "imagebuilder:getImagePolicy", "imagebuilder:getImageRecipe", "imagebuilder:getImageRecipePolicy", "imagebuilder:getInfrastructureConfiguration", "imagebuilder:getLifecycleExecution", "imagebuilder:getLifecyclePolicy", "imagebuilder:getWorkflow", "imagebuilder:getWorkflowExecution", "imagebuilder:getWorkflowStepExecution", "imagebuilder:listComponentBuildVersions", "imagebuilder:listComponents", "imagebuilder:listContainerRecipes", "imagebuilder:listDistributionConfigurations", "imagebuilder:listImageBuildVersions", "imagebuilder:listImagePipelineImages", "imagebuilder:listImagePipelines", "imagebuilder:listImageRecipes", "imagebuilder:listImages", "imagebuilder:listImageScanFindingAggregations", "imagebuilder:listInfrastructureConfigurations", "imagebuilder:listLifecycleExecutions", "imagebuilder:listLifecycleExecutionResources", "imagebuilder:listLifecyclePolicies", "imagebuilder:listWorkflowBuildVersions", "imagebuilder:listWorkflowExecutions", "imagebuilder:listWorkflows", "imagebuilder:listWorkflowStepExecutions", "imagebuilder:listTagsForResource", "inspector:describeAssessmentRuns", "inspector:describeAssessmentTargets", "inspector:describeAssessmentTemplates", "inspector:describeCrossAccountAccessRole", "inspector:describeResourceGroups", "inspector:describeRulesPackages", "inspector:getTelemetryMetadata", "inspector:listAssessmentRunAgents", "inspector:listAssessmentRuns", "inspector:listAssessmentTargets", "inspector:listAssessmentTemplates", "inspector:listEventSubscriptions", "inspector:listRulesPackages", "inspector:listTagsForResource", "inspector2:batchGetAccountStatus", "inspector2:batchGetFreeTrialInfo", "inspector2:describeOrganizationConfiguration", "inspector2:getConfiguration", "inspector2:getEc2DeepInspectionConfiguration", "inspector2:getDelegatedAdminAccount", "inspector2:getMember", "inspector2:getSbomExport", "inspector2:listCisScanConfigurations", "inspector2:listCisScanResultsAggregatedByChecks", "inspector2:listCisScanResultsAggregatedByTargetResource", "inspector2:listCisScans", "inspector2:listCoverage", "inspector2:listDelegatedAdminAccounts", "inspector2:listFilters", "inspector2:listFindings", "inspector2:listMembers", "inspector2:listUsageTotals", "inspector-scan:scanSbom", "internetmonitor:getMonitor", "internetmonitor:listMonitors", "internetmonitor:getHealthEvent", "internetmonitor:listHealthEvents", "iot:describeAuthorizer", "iot:describeCACertificate", "iot:describeCertificate", "iot:describeDefaultAuthorizer", "iot:describeDomainConfiguration", "iot:describeEndpoint", "iot:describeIndex", "iot:describeJobExecution", "iot:describeThing", "iot:describeThingGroup", "iot:describeTunnel", "iot:getEffectivePolicies", "iot:getIndexingConfiguration", "iot:getLoggingOptions", "iot:getPolicy", "iot:getPolicyVersion", "iot:getTopicRule", "iot:getV2LoggingOptions", "iot:listAttachedPolicies", "iot:listAuthorizers", "iot:listCACertificates", "iot:listCertificates", "iot:listCertificatesByCA", "iot:listDomainConfigurations", "iot:listJobExecutionsForJob", "iot:listJobExecutionsForThing", "iot:listJobs", "iot:listOutgoingCertificates", "iot:listPackages", "iot:listPackageVersions", "iot:listPolicies", "iot:listPolicyPrincipals", "iot:listPolicyVersions", "iot:listPrincipalPolicies", "iot:listPrincipalThings", "iot:listRoleAliases", "iot:listTargetsForPolicy", "iot:listThingGroups", "iot:listThingGroupsForThing", "iot:listThingPrincipals", "iot:listThingRegistrationTasks", "iot:listThings", "iot:listThingsInThingGroup", "iot:listThingTypes", "iot:listTopicRules", "iot:listTunnels", "iot:listV2LoggingLevels", "iot:listNamedShadowsForThing", "iotevents:describeDetector", "iotevents:describeDetectorModel", "iotevents:describeInput", "iotevents:describeLoggingOptions", "iotevents:listDetectorModels", "iotevents:listDetectorModelVersions", "iotevents:listDetectors", "iotevents:listInputs", "iotfleetwise:getCampaign", "iotfleetwise:getDecoderManifest", "iotfleetwise:getFleet", "iotfleetwise:getModelManifest", "iotfleetwise:getSignalCatalog", "iotfleetwise:getVehicle", "iotfleetwise:getVehicleStatus", "iotfleetwise:listCampaigns", "iotfleetwise:listDecoderManifests", "iotfleetwise:listDecoderManifestNetworkInterfaces", "iotfleetwise:listDecoderManifestSignals", "iotfleetwise:listFleets", "iotfleetwise:listFleetsForVehicle", "iotfleetwise:listModelManifests", "iotfleetwise:listModelManifestNodes", "iotfleetwise:listSignalCatalogs", "iotfleetwise:listSignalCatalogNodes", "iotfleetwise:listVehicles", "iotsitewise:describeAccessPolicy", "iotsitewise:describeAsset", "iotsitewise:describeAssetModel", "iotsitewise:describeAssetProperty", "iotsitewise:describeDashboard", "iotsitewise:describeGateway", "iotsitewise:describeGatewayCapabilityConfiguration", "iotsitewise:describeLoggingOptions", "iotsitewise:describePortal", "iotsitewise:describeProject", "iotsitewise:listAccessPolicies", "iotsitewise:listAssetModels", "iotsitewise:listAssets", "iotsitewise:listAssociatedAssets", "iotsitewise:listDashboards", "iotsitewise:listGateways", "iotsitewise:listPortals", "iotsitewise:listProjectAssets", "iotsitewise:listProjects", "iottwinmaker:getComponentType", "iottwinmaker:getEntity", "iottwinmaker:getPricingPlan", "iottwinmaker:getScene", "iottwinmaker:getWorkspace", "iottwinmaker:listComponentTypes", "iottwinmaker:listEntities", "iottwinmaker:listScenes", "iottwinmaker:getSyncJob", "iottwinmaker:listSyncJobs", "iottwinmaker:listSyncResources", "iottwinmaker:listWorkspaces", "iotwireless:getDestination", "iotwireless:getDeviceProfile", "iotwireless:getPartnerAccount", "iotwireless:getServiceEndpoint", "iotwireless:getServiceProfile", "iotwireless:getWirelessDevice", "iotwireless:getWirelessDeviceStatistics", "iotwireless:getWirelessGateway", "iotwireless:getWirelessGatewayCertificate", "iotwireless:getWirelessGatewayFirmwareInformation", "iotwireless:getWirelessGatewayStatistics", "iotwireless:getWirelessGatewayTask", "iotwireless:getWirelessGatewayTaskDefinition", "iotwireless:listDestinations", "iotwireless:listDeviceProfiles", "iotwireless:listPartnerAccounts", "iotwireless:listServiceProfiles", "iotwireless:listTagsForResource", "iotwireless:listWirelessDevices", "iotwireless:listWirelessGateways", "iotwireless:listWirelessGatewayTaskDefinitions", "ivs:getChannel", "ivs:getRecordingConfiguration", "ivs:getStream", "ivs:getStreamSession", "ivs:listChannels", "ivs:listPlaybackKeyPairs", "ivs:listRecordingConfigurations", "ivs:listStreamKeys", "ivs:listStreams", "ivs:listStreamSessions", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listConfigurations", "kafka:listConfigurationRevisions", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "kendra:describeDataSource", "kendra:describeFaq", "kendra:describeIndex", "kendra:listDataSources", "kendra:listFaqs", "kendra:listIndices", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", "kinesis:listShards", "kinesis:listStreams", "kinesis:listStreamConsumers", "kinesis:listTagsForStream", "kinesisanalytics:describeApplication", "kinesisanalytics:describeApplicationSnapshot", "kinesisanalytics:listApplications", "kinesisanalytics:listApplicationSnapshots", "kinesisanalytics:describeApplicationOperation", "kinesisanalytics:listApplicationOperations", "kinesisanalytics:listApplicationVersions", "kinesisvideo:describeImageGenerationConfiguration", "kinesisvideo:describeNotificationConfiguration", "kinesisvideo:describeSignalingChannel", "kinesisvideo:describeStream", "kinesisvideo:getDataEndpoint", "kinesisvideo:getIceServerConfig", "kinesisvideo:getSignalingChannelEndpoint", "kinesisvideo:listSignalingChannels", "kinesisvideo:listStreams", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listFunctionUrlConfigs", "lambda:listLayers", "lambda:listLayerVersions", "lambda:listProvisionedConcurrencyConfigs", "lambda:listTags", "lambda:listVersionsByFunction", "lambda:getFunctionRecursionConfig", "launchwizard:describeProvisionedApp", "launchwizard:describeProvisioningEvents", "launchwizard:listProvisionedApps", "launchwizard:listDeployments", "launchwizard:listDeploymentEvents", "lex:describeBot", "lex:describeBotAlias", "lex:describeBotLocale", "lex:describeBotRecommendation", "lex:describeBotVersion", "lex:describeCustomVocabularyMetadata", "lex:describeExport", "lex:describeImport", "lex:describeIntent", "lex:describeResourcePolicy", "lex:describeSlot", "lex:describeSlotType", "lex:getBot", "lex:getBotAlias", "lex:getBotAliases", "lex:getBotChannelAssociation", "lex:getBotChannelAssociations", "lex:getBots", "lex:getBotVersions", "lex:getBuiltinIntent", "lex:getBuiltinIntents", "lex:getBuiltinSlotTypes", "lex:getIntent", "lex:getIntents", "lex:getIntentVersions", "lex:getSlotType", "lex:getSlotTypes", "lex:getSlotTypeVersions", "lex:listBotAliases", "lex:listBotLocales", "lex:listBotRecommendations", "lex:listBots", "lex:listBotVersions", "lex:listExports", "lex:listImports", "lex:listIntents", "lex:listRecommendedIntents", "lex:listSlots", "lex:listSlotTypes", "license-manager:getLicenseConfiguration", "license-manager:getServiceSettings", "license-manager:listAssociationsForLicenseConfiguration", "license-manager:listFailuresForLicenseConfigurationOperations", "license-manager:listLicenseConfigurations", "license-manager:listLicenseSpecificationsForResource", "license-manager:listResourceInventory", "license-manager:listUsageForLicenseConfiguration", "lightsail:getActiveNames", "lightsail:getAlarms", "lightsail:getAutoSnapshots", "lightsail:getBlueprints", "lightsail:getBucketBundles", "lightsail:getBucketMetricData", "lightsail:getBuckets", "lightsail:getBundles", "lightsail:getCertificates", "lightsail:getContainerImages", "lightsail:getContainerServiceDeployments", "lightsail:getContainerServiceMetricData", "lightsail:getContainerServicePowers", "lightsail:getContainerServices", "lightsail:getDisk", "lightsail:getDisks", "lightsail:getDiskSnapshot", "lightsail:getDiskSnapshots", "lightsail:getDistributionBundles", "lightsail:getDistributionMetricData", "lightsail:getDistributions", "lightsail:getDomain", "lightsail:getDomains", "lightsail:getExportSnapshotRecords", "lightsail:getInstance", "lightsail:getInstanceMetricData", "lightsail:getInstancePortStates", "lightsail:getInstances", "lightsail:getInstanceSnapshot", "lightsail:getInstanceSnapshots", "lightsail:getInstanceState", "lightsail:getKeyPair", "lightsail:getKeyPairs", "lightsail:getLoadBalancer", "lightsail:getLoadBalancerMetricData", "lightsail:getLoadBalancers", "lightsail:getLoadBalancerTlsCertificates", "lightsail:getOperation", "lightsail:getOperations", "lightsail:getOperationsForResource", "lightsail:getRegions", "lightsail:getRelationalDatabase", "lightsail:getRelationalDatabaseMetricData", "lightsail:getRelationalDatabases", "lightsail:getRelationalDatabaseSnapshot", "lightsail:getRelationalDatabaseSnapshots", "lightsail:getStaticIp", "lightsail:getStaticIps", "lightsail:isVpcPeered", "logs:describeAccountPolicies", "logs:describeDeliveries", "logs:describeDeliveryDestinations", "logs:describeDeliverySources", "logs:describeDestinations", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeQueries", "logs:describeQueryDefinitions", "logs:describeResourcePolicies", "logs:describeSubscriptionFilters", "logs:getDataProtectionPolicy", "logs:getDelivery", "logs:getDeliveryDestination", "logs:getDeliveryDestinationPolicy", "logs:getDeliverySource", "logs:getLogAnomalyDetector", "logs:getLogDelivery", "logs:getLogGroupFields", "logs:listAnomalies", "logs:listLogAnomalyDetectors", "logs:listLogDeliveries", "logs:testMetricFilter", "lookoutequipment:describeDataIngestionJob", "lookoutequipment:describeDataset", "lookoutequipment:describeInferenceScheduler", "lookoutequipment:describeModel", "lookoutequipment:listDataIngestionJobs", "lookoutequipment:listDatasets", "lookoutequipment:listInferenceExecutions", "lookoutequipment:listInferenceSchedulers", "lookoutequipment:listModels", "lookoutmetrics:describeAlert", "lookoutmetrics:describeAnomalyDetectionExecutions", "lookoutmetrics:describeAnomalyDetector", "lookoutmetrics:describeMetricSet", "lookoutmetrics:getAnomalyGroup", "lookoutmetrics:getDataQualityMetrics", "lookoutmetrics:getFeedback", "lookoutmetrics:getSampleData", "lookoutmetrics:listAlerts", "lookoutmetrics:listAnomalyDetectors", "lookoutmetrics:listAnomalyGroupSummaries", "lookoutmetrics:listAnomalyGroupTimeSeries", "lookoutmetrics:listMetricSets", "lookoutmetrics:listTagsForResource", "machinelearning:describeBatchPredictions", "machinelearning:describeDataSources", "machinelearning:describeEvaluations", "machinelearning:describeMLModels", "machinelearning:getBatchPrediction", "machinelearning:getDataSource", "machinelearning:getEvaluation", "machinelearning:getMLModel", "macie2:getClassificationExportConfiguration", "macie2:getCustomDataIdentifier", "macie2:getFindings", "macie2:getFindingStatistics", "macie2:listClassificationJobs", "macie2:listCustomDataIdentifiers", "macie2:listFindings", "managedblockchain:getMember", "managedblockchain:getNetwork", "managedblockchain:getNode", "managedblockchain:listMembers", "managedblockchain:listNetworks", "managedblockchain:listNodes", "mediaconnect:describeFlow", "mediaconnect:listEntitlements", "mediaconnect:listFlows", "mediaconvert:describeEndpoints", "mediaconvert:getJob", "mediaconvert:getJobTemplate", "mediaconvert:getPreset", "mediaconvert:getQueue", "mediaconvert:listJobs", "mediaconvert:listJobTemplates", "medialive:describeChannel", "medialive:describeInput", "medialive:describeInputDevice", "medialive:describeInputSecurityGroup", "medialive:describeMultiplex", "medialive:describeOffering", "medialive:describeReservation", "medialive:describeSchedule", "medialive:listChannels", "medialive:listInputDevices", "medialive:listInputs", "medialive:listInputSecurityGroups", "medialive:listMultiplexes", "medialive:listOfferings", "medialive:listReservations", "mediapackage:describeChannel", "mediapackage:describeOriginEndpoint", "mediapackage:listChannels", "mediapackage:listOriginEndpoints", "mediastore:describeContainer", "mediastore:getContainerPolicy", "mediastore:getCorsPolicy", "mediastore:listContainers", "mediatailor:getPlaybackConfiguration", "mediatailor:listPlaybackConfigurations", "medical-imaging:getDatastore", "medical-imaging:listDatastores", "mgn:describeJobLogItems", "mgn:describeJobs", "mgn:describeLaunchConfigurationTemplates", "mgn:describeReplicationConfigurationTemplates", "mgn:describeSourceServers", "mgn:describeVcenterClients", "mgn:getLaunchConfiguration", "mgn:getReplicationConfiguration", "mgn:listApplications", "mgn:listSourceServerActions", "mgn:listTemplateActions", "mgn:listWaves", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApp", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaigns", "mobiletargeting:getCampaignVersion", "mobiletargeting:getCampaignVersions", "mobiletargeting:getEmailChannel", "mobiletargeting:getEndpoint", "mobiletargeting:getEventStream", "mobiletargeting:getExportJob", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJob", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegments", "mobiletargeting:getSegmentVersion", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "mq:describeBroker", "mq:describeConfiguration", "mq:describeConfigurationRevision", "mq:describeUser", "mq:listBrokers", "mq:listConfigurationRevisions", "mq:listConfigurations", "mq:listUsers", "m2:getApplication", "m2:getApplicationVersion", "m2:getBatchJobExecution", "m2:getDataSetDetails", "m2:getDataSetImportTask", "m2:getDeployment", "m2:getEnvironment", "m2:listApplications", "m2:listApplicationVersions", "m2:listBatchJobDefinitions", "m2:listBatchJobExecutions", "m2:listDataSetImportHistory", "m2:listDataSets", "m2:listDeployments", "m2:listEngineVersions", "m2:listEnvironments", "network-firewall:describeFirewall", "network-firewall:describeFirewallPolicy", "network-firewall:describeLoggingConfiguration", "network-firewall:describeRuleGroup", "network-firewall:describeTlsInspectionConfiguration", "network-firewall:listFirewallPolicies", "network-firewall:listFirewalls", "network-firewall:listRuleGroups", "network-firewall:listTlsInspectionConfigurations", "networkmanager:describeGlobalNetworks", "networkmanager:getConnectAttachment", "networkmanager:getConnections", "networkmanager:getConnectPeer", "networkmanager:getConnectPeerAssociations", "networkmanager:getCoreNetwork", "networkmanager:getCoreNetworkChangeEvents", "networkmanager:getCoreNetworkChangeSet", "networkmanager:getCoreNetworkPolicy", "networkmanager:getCustomerGatewayAssociations", "networkmanager:getDevices", "networkmanager:getLinkAssociations", "networkmanager:getLinks", "networkmanager:getNetworkResourceCounts", "networkmanager:getNetworkResourceRelationships", "networkmanager:getNetworkResources", "networkmanager:getNetworkRoutes", "networkmanager:getNetworkTelemetry", "networkmanager:getResourcePolicy", "networkmanager:getRouteAnalysis", "networkmanager:getSites", "networkmanager:getSiteToSiteVpnAttachment", "networkmanager:getTransitGatewayConnectPeerAssociations", "networkmanager:getTransitGatewayPeering", "networkmanager:getTransitGatewayRegistrations", "networkmanager:getTransitGatewayRouteTableAttachment", "networkmanager:getVpcAttachment", "networkmanager:listAttachments", "networkmanager:listConnectPeers", "networkmanager:listCoreNetworkPolicyVersions", "networkmanager:listCoreNetworks", "networkmanager:listOrganizationServiceAccessStatus", "networkmanager:listPeerings", "networkmanager:listTagsForResource", "networkmonitor:getMonitor", "networkmonitor:getProbe", "networkmonitor:listMonitors", "notifications:getEventRule", "notifications:getNotificationConfiguration", "notifications:getNotificationEvent", "notifications:listChannels", "notifications:listEventRules", "notifications:listNotificationConfigurations", "notifications:listNotificationEvents", "notifications:listNotificationHubs", "notifications-contacts:getEmailContact", "notifications-contacts:listEmailContacts", "oam:getLink", "oam:getSink", "oam:getSinkPolicy", "oam:listAttachedLinks", "oam:listLinks", "oam:listSinks", "omics:getAnnotationImportJob", "omics:getAnnotationStore", "omics:getReadSetImportJob", "omics:getReadSetMetadata", "omics:getReference", "omics:getReferenceImportJob", "omics:getReferenceMetadata", "omics:getReferenceStore", "omics:getRun", "omics:getRunGroup", "omics:getSequenceStore", "omics:getVariantImportJob", "omics:getVariantStore", "omics:getWorkflow", "omics:listAnnotationImportJobs", "omics:listAnnotationStores", "omics:listMultipartReadSetUploads", "omics:listReadSetImportJobs", "omics:listReadSets", "omics:listReadSetUploadParts", "omics:listReferenceImportJobs", "omics:listReferenceStores", "omics:listReferences", "omics:listRunGroups", "omics:listRunTasks", "omics:listRuns", "omics:listSequenceStores", "omics:listVariantImportJobs", "omics:listVariantStores", "omics:listWorkflows", "opsworks-cm:describeAccountAttributes", "opsworks-cm:describeBackups", "opsworks-cm:describeEvents", "opsworks-cm:describeNodeAssociationStatus", "opsworks-cm:describeServers", "opsworks:describeAgentVersions", "opsworks:describeApps", "opsworks:describeCommands", "opsworks:describeDeployments", "opsworks:describeEcsClusters", "opsworks:describeElasticIps", "opsworks:describeElasticLoadBalancers", "opsworks:describeInstances", "opsworks:describeLayers", "opsworks:describeLoadBasedAutoScaling", "opsworks:describeMyUserProfile", "opsworks:describePermissions", "opsworks:describeRaidArrays", "opsworks:describeRdsDbInstances", "opsworks:describeServiceErrors", "opsworks:describeStackProvisioningParameters", "opsworks:describeStacks", "opsworks:describeStackSummary", "opsworks:describeTimeBasedAutoScaling", "opsworks:describeUserProfiles", "opsworks:describeVolumes", "opsworks:getHostnameSuggestion", "organizations:listAccounts", "organizations:listTagsForResource", "osis:getPipeline", "osis:getPipelineBlueprint", "osis:getPipelineChangeProgress", "osis:listPipelineBlueprints", "osis:listPipelines", "osis:validatePipeline", "outposts:getCatalogItem", "outposts:getConnection", "outposts:getOrder", "outposts:getOutpost", "outposts:getOutpostInstanceTypes", "outposts:getSite", "outposts:listAssets", "outposts:listCatalogItems", "outposts:listOrders", "outposts:listOutposts", "outposts:listSites", "personalize:describeAlgorithm", "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", "personalize:describeDatasetImportJob", "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", "personalize:describeSolution", "personalize:describeSolutionVersion", "personalize:getPersonalizedRanking", "personalize:getRecommendations", "personalize:getSolutionMetrics", "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", "personalize:listSolutions", "personalize:listSolutionVersions", "pipes:describePipe", "pipes:listPipes", "pipes:listTagsForResource", "polly:describeVoices", "polly:getLexicon", "polly:listLexicons", "pricing:describeServices", "pricing:getAttributeValues", "pricing:getProducts", "private-networks:getDeviceIdentifier", "private-networks:getNetwork", "private-networks:getNetworkResource", "private-networks:listDeviceIdentifiers", "private-networks:listNetworks", "private-networks:listNetworkResources", "qbusiness:getApplication", "qbusiness:getDataSource", "qbusiness:getIndex", "qbusiness:getRetriever", "qbusiness:getWebExperience", "qbusiness:listApplications", "qbusiness:listDataSources", "qbusiness:listDataSourceSyncJobs", "qbusiness:listIndices", "qbusiness:listRetrievers", "qbusiness:listWebExperiences", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetPermissions", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeDataSourcePermissions", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicPermissions", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboards", "quicksight:listDashboardVersions", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplates", "quicksight:listTemplateVersions", "quicksight:listThemeAliases", "quicksight:listThemes", "quicksight:listThemeVersions", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "ram:getPermission", "ram:getResourceShareAssociations", "ram:getResourceShareInvitations", "ram:getResourceShares", "ram:listPendingInvitationResources", "ram:listPrincipals", "ram:listResources", "ram:listResourceSharePermissions", "rbin:getRule", "rbin:listRules", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusters", "rds:describeDBClusterSnapshots", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEvents", "rds:describeEventSubscriptions", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEvents", "redshift:describeEventSubscriptions", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "rekognition:listCollections", "rekognition:listFaces", "resource-explorer-2:getAccountLevelServiceConfiguration", "resource-explorer-2:getIndex", "resource-explorer-2:getView", "resource-explorer-2:listIndexes", "resource-explorer-2:listViews", "resource-explorer-2:search", "resource-groups:getGroup", "resource-groups:getGroupQuery", "resource-groups:getTags", "resource-groups:listGroupResources", "resource-groups:listGroups", "resource-groups:searchResources", "robomaker:batchDescribeSimulationJob", "robomaker:describeDeploymentJob", "robomaker:describeFleet", "robomaker:describeRobot", "robomaker:describeRobotApplication", "robomaker:describeSimulationApplication", "robomaker:describeSimulationJob", "robomaker:listDeploymentJobs", "robomaker:listFleets", "robomaker:listRobotApplications", "robomaker:listRobots", "robomaker:listSimulationApplications", "robomaker:listSimulationJobs", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53profiles:getProfile", "route53profiles:listProfileAssociations", "route53profiles:listProfileResourceAssociations", "route53profiles:listProfiles", "route53profiles:listTagsForResource", "route53profiles:getProfileResourceAssociation", "route53profiles:getProfileAssociation", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "rum:batchGetRumMetricDefinitions", "rum:getAppMonitor", "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultipartUploadParts", "s3:listMultiRegionAccessPoints", "s3:listStorageLensConfigurations", "s3express:getBucketPolicy", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCluster", "sagemaker:describeClusterNode", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceComponent", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContents", "sagemaker:listHubContentVersions", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImages", "sagemaker:listImageVersions", "sagemaker:listInferenceComponents", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCards", "sagemaker:listModelCardVersions", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", "scheduler:listScheduleGroups", "scheduler:listSchedules", "schemas:describeCodeBinding", "schemas:describeDiscoverer", "schemas:describeRegistry", "schemas:describeSchema", "schemas:getCodeBindingSource", "schemas:getDiscoveredSchema", "schemas:getResourcePolicy", "schemas:listDiscoverers", "schemas:listRegistries", "schemas:listSchemas", "schemas:listSchemaVersions", "sdb:domainMetadata", "sdb:listDomains", "secretsmanager:describeSecret", "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", "securityhub:getEnabledStandards", "securityhub:getFindings", "securityhub:getInsightResults", "securityhub:getInsights", "securityhub:getMasterAccount", "securityhub:getMembers", "securityhub:listEnabledProductsForImport", "securityhub:listInvitations", "securityhub:listMembers", "securityhub:describeOrganizationConfiguration", "securityhub:batchGetConfigurationPolicyAssociations", "securityhub:getConfigurationPolicy", "securityhub:getConfigurationPolicyAssociation", "securityhub:listConfigurationPolicies", "securityhub:listConfigurationPolicyAssociations", "securityhub:getFindingAggregator", "securityhub:listFindingAggregators", "securitylake:getDataLakeExceptionSubscription", "securitylake:getDataLakeOrganizationConfiguration", "securitylake:getDataLakeSources", "securitylake:getSubscriber", "securitylake:listDataLakeExceptions", "securitylake:listDataLakes", "securitylake:listLogSources", "securitylake:listSubscribers", "serverlessrepo:getApplication", "serverlessrepo:getApplicationPolicy", "serverlessrepo:getCloudFormationTemplate", "serverlessrepo:listApplicationDependencies", "serverlessrepo:listApplications", "serverlessrepo:listApplicationVersions", "servicecatalog:describeConstraint", "servicecatalog:describePortfolio", "servicecatalog:describeProduct", "servicecatalog:describeProductAsAdmin", "servicecatalog:describeProductView", "servicecatalog:describeProvisioningArtifact", "servicecatalog:describeProvisioningParameters", "servicecatalog:describeRecord", "servicecatalog:listAcceptedPortfolioShares", "servicecatalog:listConstraintsForPortfolio", "servicecatalog:listLaunchPaths", "servicecatalog:listPortfolioAccess", "servicecatalog:listPortfolios", "servicecatalog:listPortfoliosForProduct", "servicecatalog:listPrincipalsForPortfolio", "servicecatalog:listProvisioningArtifacts", "servicecatalog:listRecordHistory", "servicecatalog:scanProvisionedProducts", "servicecatalog:searchProducts", "servicequotas:getAssociationForServiceQuotaTemplate", "servicequotas:getAWSDefaultServiceQuota", "servicequotas:getRequestedServiceQuotaChange", "servicequotas:getServiceQuota", "servicequotas:getServiceQuotaIncreaseRequestFromTemplate", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listRequestedServiceQuotaChangeHistory", "servicequotas:listRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:listServiceQuotaIncreaseRequestsInTemplate", "servicequotas:listServiceQuotas", "servicequotas:listServices", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "shield:describeAttack", "shield:describeProtection", "shield:describeSubscription", "shield:listAttacks", "shield:listProtections", "sms-voice:getConfigurationSetEventDestinations", "sms:getConnectors", "sms:getReplicationJobs", "sms:getReplicationRuns", "sms:getServers", "snowball:describeAddress", "snowball:describeAddresses", "snowball:describeJob", "snowball:getSnowballUsage", "snowball:listJobs", "snowball:listServiceVersions", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "sqs:getQueueAttributes", "sqs:getQueueUrl", "sqs:listDeadLetterSourceQueues", "sqs:listQueues", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotations", "ssm-contacts:listRotationShifts", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutions", "ssm:describeAssociationExecutionTargets", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatches", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroups", "ssm:describePatchGroupState", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociations", "ssm:listAssociationVersions", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocuments", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "sso:describeApplicationAssignment", "sso:describeApplicationProvider", "sso:describeApplication", "sso:describeInstance", "sso:describeTrustedTokenIssuer", "sso:getApplicationAccessScope", "sso:getApplicationAssignmentConfiguration", "sso:getApplicationAuthenticationMethod", "sso:getApplicationGrant", "sso:getApplicationInstance", "sso:getApplicationTemplate", "sso:getManagedApplicationInstance", "sso:getSharedSsoConfiguration", "sso:listApplicationAccessScopes", "sso:listApplicationAssignments", "sso:listApplicationAuthenticationMethods", "sso:listApplicationGrants", "sso:listApplicationInstances", "sso:listApplicationProviders", "sso:listApplications", "sso:listApplicationTemplates", "sso:listDirectoryAssociations", "sso:listInstances", "sso:listProfileAssociations", "sso:listTrustedTokenIssuers", "states:describeActivity", "states:describeExecution", "states:describeMapRun", "states:describeStateMachine", "states:describeStateMachineAlias", "states:describeStateMachineForExecution", "states:getExecutionHistory", "states:listActivities", "states:listExecutions", "states:listMapRuns", "states:listStateMachineAliases", "states:listStateMachines", "states:listStateMachineVersions", "storagegateway:describeBandwidthRateLimit", "storagegateway:describeCache", "storagegateway:describeCachediSCSIVolumes", "storagegateway:describeFileSystemAssociations", "storagegateway:describeGatewayInformation", "storagegateway:describeMaintenanceStartTime", "storagegateway:describeNFSFileShares", "storagegateway:describeSMBFileShares", "storagegateway:describeSMBSettings", "storagegateway:describeSnapshotSchedule", "storagegateway:describeStorediSCSIVolumes", "storagegateway:describeTapeArchives", "storagegateway:describeTapeRecoveryPoints", "storagegateway:describeTapes", "storagegateway:describeUploadBuffer", "storagegateway:describeVTLDevices", "storagegateway:describeWorkingStorage", "storagegateway:listAutomaticTapeCreationPolicies", "storagegateway:listFileShares", "storagegateway:listFileSystemAssociations", "storagegateway:listGateways", "storagegateway:listLocalDisks", "storagegateway:listTagsForResource", "storagegateway:listTapes", "storagegateway:listVolumeInitiators", "storagegateway:listVolumeRecoveryPoints", "storagegateway:listVolumes", "swf:countClosedWorkflowExecutions", "swf:countOpenWorkflowExecutions", "swf:countPendingActivityTasks", "swf:countPendingDecisionTasks", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", "synthetics:getCanary", "synthetics:getCanaryRuns", "synthetics:getGroup", "synthetics:listAssociatedGroups", "synthetics:listGroupResources", "synthetics:listGroups", "tiros:createQuery", "tiros:getQueryAnswer", "tiros:getQueryExplanation", "transcribe:describeLanguageModel", "transcribe:getCallAnalyticsCategory", "transcribe:getCallAnalyticsJob", "transcribe:getMedicalTranscriptionJob", "transcribe:getMedicalVocabulary", "transcribe:getTranscriptionJob", "transcribe:getVocabulary", "transcribe:getVocabularyFilter", "transcribe:listCallAnalyticsCategories", "transcribe:listCallAnalyticsJobs", "transcribe:listLanguageModels", "transcribe:listMedicalTranscriptionJobs", "transcribe:listMedicalVocabularies", "transcribe:listTranscriptionJobs", "transcribe:listVocabularies", "transcribe:listVocabularyFilters", "transfer:describeAccess", "transfer:describeAgreement", "transfer:describeConnector", "transfer:describeExecution", "transfer:describeProfile", "transfer:describeServer", "transfer:describeUser", "transfer:describeWorkflow", "transfer:listAccesses", "transfer:listAgreements", "transfer:listConnectors", "transfer:listExecutions", "transfer:listHostKeys", "transfer:listProfiles", "transfer:listServers", "transfer:listTagsForResource", "transfer:listUsers", "transfer:listWorkflows", "transfer:sendWorkflowStepState", "trustedadvisor:getOrganizationRecommendation", "trustedadvisor:getRecommendation", "trustedadvisor:listChecks", "trustedadvisor:listOrganizationRecommendationAccounts", "trustedadvisor:listOrganizationRecommendationResources", "trustedadvisor:listOrganizationRecommendations", "trustedadvisor:listRecommendationResources", "trustedadvisor:listRecommendations", "verifiedpermissions:getIdentitySource", "verifiedpermissions:getPolicy", "verifiedpermissions:getPolicyStore", "verifiedpermissions:getPolicyTemplate", "verifiedpermissions:getSchema", "verifiedpermissions:listIdentitySources", "verifiedpermissions:listPolicies", "verifiedpermissions:listPolicyStores", "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workdocs:checkAlias", "workdocs:describeAvailableDirectories", "workdocs:describeInstances", "workmail:describeGroup", "workmail:describeOrganization", "workmail:describeResource", "workmail:describeUser", "workmail:listAliases", "workmail:listGroupMembers", "workmail:listGroups", "workmail:listMailboxPermissions", "workmail:listOrganizations", "workmail:listResourceDelegates", "workmail:listResources", "workmail:listUsers", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeApplicationAssociations", "workspaces:describeWorkspaceAssociations", "workspaces:describeWorkspacesPools", "workspaces:describeWorkspacesPoolSessions", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus", "xray:getEncryptionConfig", "xray:getGroup", "xray:getGroups", "xray:getSamplingRules", "xray:listResourcePolicies", "xray:getInsightImpactGraph", "xray:getSamplingStatisticSummaries", "xray:getSamplingTargets", "xray:getServiceGraph", "xray:getTimeSeriesServiceStatistics", "xray:getTraceGraph" ], "Effect": "Allow", "Resource": [ "*" ] } ], "Version": "2012-10-17" } } }, "createdDate": "2018-04-19T18:04:44.000Z", "lastUpdatedDate": "2024-12-12T00:06:26.000Z" }, "AWSBudgetsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSBudgetsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-10-15T17:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:ViewBilling", "budgets:ViewBudget", "budgets:Describe*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2020-10-15T17:18:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSBudgetsReadOnlyAccess", "Effect": "Allow", "Action": [ "aws-portal:ViewBilling", "budgets:ViewBudget", "budgets:Describe*", "budgets:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-15T17:18:28.000Z", "lastUpdatedDate": "2024-06-17T17:41:25.000Z" }, "AWSBudgetsActionsWithAWSResourceControlAccess": { "arn": "arn:aws:iam::aws:policy/AWSBudgetsActionsWithAWSResourceControlAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-10-15T17:19:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "budgets:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-portal:ViewBilling" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "budgets.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "aws-portal:ModifyBilling", "ec2:DescribeInstances", "iam:ListGroups", "iam:ListPolicies", "iam:ListRoles", "iam:ListUsers", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:ListPolicies", "organizations:ListRoots", "rds:DescribeDBInstances", "sns:ListTopics" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-15T17:19:12.000Z", "lastUpdatedDate": "2020-10-15T17:19:12.000Z" }, "AWSDataLifecycleManagerServiceRoleForAMIManagement": { "arn": "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRoleForAMIManagement", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-08-19T17:03:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeImageAttribute", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:ResetImageAttribute", "ec2:DeregisterImage", "ec2:CreateImage", "ec2:CopyImage", "ec2:ModifyImageAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:EnableImageDeprecation", "ec2:DisableImageDeprecation" ], "Resource": "arn:aws:ec2:*::image/*" } ] } }, "v1": { "createdDate": "2020-10-21T19:39:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*::image/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeImageAttribute", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteSnapshot", "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:ResetImageAttribute", "ec2:DeregisterImage", "ec2:CreateImage", "ec2:CopyImage", "ec2:ModifyImageAttribute" ], "Resource": "*" } ] } } }, "createdDate": "2020-10-21T19:39:41.000Z", "lastUpdatedDate": "2021-08-19T17:03:44.000Z" }, "AmazonMQServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonMQServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-04T16:07:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AMQManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AMQManaged": "true" } } }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/amazonmq/*" ] } ] } } }, "createdDate": "2020-11-04T16:07:17.000Z", "lastUpdatedDate": "2020-11-04T16:07:17.000Z" }, "AWSOutpostsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSOutpostsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-09T22:55:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup" ], "Resource": "*" } ] } } }, "createdDate": "2020-11-09T22:55:56.000Z", "lastUpdatedDate": "2020-11-09T22:55:56.000Z" }, "AwsGlueDataBrewFullAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AwsGlueDataBrewFullAccessPolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v3": { "createdDate": "2021-03-30T17:03:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "databrew:*", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v1": { "createdDate": "2020-11-11T16:51:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "databrew:*", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2020-11-12T23:04:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "databrew:*", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2021-06-30T16:50:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "databrew:*", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:table/*/awsgluedatabrew*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2021-06-30T18:23:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "databrew:*", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*/awsgluedatabrew*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2021-04-28T15:54:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "databrew:*", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2021-11-18T19:37:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "databrew:*", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*/awsgluedatabrew*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AwsGlueDataBrew-*" }, { "Effect": "Allow", "Action": [ "kms:GenerateRandom" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "databrew.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*", "Condition": { "StringLike": { "secretsmanager:Name": "databrew!default" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "databrew.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2022-02-04T18:28:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "databrew:CreateDataset", "databrew:DescribeDataset", "databrew:ListDatasets", "databrew:UpdateDataset", "databrew:DeleteDataset", "databrew:CreateProject", "databrew:DescribeProject", "databrew:ListProjects", "databrew:StartProjectSession", "databrew:SendProjectSessionAction", "databrew:UpdateProject", "databrew:DeleteProject", "databrew:CreateRecipe", "databrew:DescribeRecipe", "databrew:ListRecipes", "databrew:ListRecipeVersions", "databrew:PublishRecipe", "databrew:UpdateRecipe", "databrew:BatchDeleteRecipeVersion", "databrew:DeleteRecipeVersion", "databrew:CreateRecipeJob", "databrew:CreateProfileJob", "databrew:DescribeJob", "databrew:DescribeJobRun", "databrew:ListJobRuns", "databrew:ListJobs", "databrew:StartJobRun", "databrew:StopJobRun", "databrew:UpdateProfileJob", "databrew:UpdateRecipeJob", "databrew:DeleteJob", "databrew:CreateSchedule", "databrew:DescribeSchedule", "databrew:ListSchedules", "databrew:UpdateSchedule", "databrew:DeleteSchedule", "databrew:CreateRuleset", "databrew:DeleteRuleset", "databrew:DescribeRuleset", "databrew:ListRulesets", "databrew:UpdateRuleset", "databrew:ListTagsForResource", "databrew:TagResource", "databrew:UntagResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetDataCatalogEncryptionSettings", "dataexchange:ListDataSets", "dataexchange:ListDataSetRevisions", "dataexchange:ListRevisionAssets", "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:GetJob", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift-data:DescribeStatement", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "s3:ListAllMyBuckets", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "sts:GetCallerIdentity", "cloudtrail:LookupEvents", "iam:ListRoles", "iam:GetRole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AwsGlueDataBrew-*" ] }, { "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*/awsgluedatabrew*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AwsGlueDataBrew-*" }, { "Effect": "Allow", "Action": [ "kms:GenerateRandom" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "databrew.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*", "Condition": { "StringLike": { "secretsmanager:Name": "databrew!default" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "databrew.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "databrew.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-11-11T16:51:39.000Z", "lastUpdatedDate": "2022-02-04T18:28:33.000Z" }, "DynamoDBKinesisReplicationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/DynamoDBKinesisReplicationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-12T00:43:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "kinesis.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream" ], "Resource": "*" } ] } } }, "createdDate": "2020-11-12T00:43:25.000Z", "lastUpdatedDate": "2020-11-12T00:43:25.000Z" }, "AWSServiceCatalogAppRegistryFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogAppRegistryFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2020-11-12T22:25:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-08-24T17:06:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:UpdateStack" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:SyncResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:ListTagsForResource", "servicecatalog:UntagResource", "servicecatalog:TagResource" ], "Resource": "arn:aws:servicecatalog:*:*:*" } ] } }, "v4": { "createdDate": "2022-11-17T18:13:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:UpdateStack" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag", "resource-groups:GetGroupConfiguration" ], "Resource": "arn:aws:resource-groups:*:*:group/AWS_*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:SyncResource", "servicecatalog:ListAttributeGroupsForApplication", "servicecatalog:GetConfiguration", "servicecatalog:PutConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:ListTagsForResource", "servicecatalog:UntagResource", "servicecatalog:TagResource" ], "Resource": "arn:aws:servicecatalog:*:*:*" } ] } }, "v3": { "createdDate": "2022-06-15T22:01:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:UpdateStack" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:SyncResource", "servicecatalog:ListAttributeGroupsForApplication" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:ListTagsForResource", "servicecatalog:UntagResource", "servicecatalog:TagResource" ], "Resource": "arn:aws:servicecatalog:*:*:*" } ] } }, "v5": { "createdDate": "2020-11-12T22:25:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AppRegistryUpdateStack", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryResourceGroupsIntegration", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag", "resource-groups:GetGroupConfiguration", "resource-groups:AssociateResource", "resource-groups:DisassociateResource" ], "Resource": "arn:aws:resource-groups:*:*:group/AWS_*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryOperations", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:SyncResource", "servicecatalog:ListAttributeGroupsForApplication", "servicecatalog:GetConfiguration", "servicecatalog:PutConfiguration" ], "Resource": "*" }, { "Sid": "AppRegistryResourceTagging", "Effect": "Allow", "Action": [ "servicecatalog:ListTagsForResource", "servicecatalog:UntagResource", "servicecatalog:TagResource" ], "Resource": "arn:aws:servicecatalog:*:*:*" } ] } }, "v6": { "createdDate": "2020-11-12T22:25:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AppRegistryUpdateStackAndResourceGroupTagging", "Effect": "Allow", "Action": [ "cloudformation:UpdateStack", "tag:GetResources" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryResourceGroupsIntegration", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag", "resource-groups:GetGroupConfiguration", "resource-groups:AssociateResource", "resource-groups:DisassociateResource" ], "Resource": "arn:aws:resource-groups:*:*:group/AWS_*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "AppRegistryOperations", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "servicecatalog:CreateApplication", "servicecatalog:GetApplication", "servicecatalog:UpdateApplication", "servicecatalog:DeleteApplication", "servicecatalog:ListApplications", "servicecatalog:AssociateResource", "servicecatalog:DisassociateResource", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:CreateAttributeGroup", "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:SyncResource", "servicecatalog:ListAttributeGroupsForApplication", "servicecatalog:GetConfiguration", "servicecatalog:PutConfiguration" ], "Resource": "*" }, { "Sid": "AppRegistryResourceTagging", "Effect": "Allow", "Action": [ "servicecatalog:ListTagsForResource", "servicecatalog:UntagResource", "servicecatalog:TagResource" ], "Resource": "arn:aws:servicecatalog:*:*:*" } ] } } }, "createdDate": "2020-11-12T22:25:58.000Z", "lastUpdatedDate": "2023-12-07T21:50:00.000Z" }, "AWSServiceCatalogAppRegistryReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSServiceCatalogAppRegistryReadOnlyAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-11-12T22:34:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicecatalog:GetApplication", "servicecatalog:ListApplications", "servicecatalog:ListAssociatedResources", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-08-24T17:03:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicecatalog:GetApplication", "servicecatalog:ListApplications", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:ListTagsForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-06-15T20:20:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicecatalog:GetApplication", "servicecatalog:ListApplications", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:ListTagsForResource", "servicecatalog:ListAttributeGroupsForApplication" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-11-17T18:16:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicecatalog:GetApplication", "servicecatalog:ListApplications", "servicecatalog:GetAssociatedResource", "servicecatalog:ListAssociatedResources", "servicecatalog:ListAssociatedAttributeGroups", "servicecatalog:GetAttributeGroup", "servicecatalog:ListAttributeGroups", "servicecatalog:ListTagsForResource", "servicecatalog:ListAttributeGroupsForApplication", "servicecatalog:GetConfiguration" ], "Resource": "*" } ] } } }, "createdDate": "2020-11-12T22:34:32.000Z", "lastUpdatedDate": "2022-11-17T18:16:39.000Z" }, "AWSNetworkFirewallServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v3": { "createdDate": "2023-03-30T17:19:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "acm:DescribeCertificate", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroupResources", "Resource": "*" }, { "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "resource-groups.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/AWSNetworkFirewallManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSNetworkFirewallManaged": "true" } } } ] } }, "v2": { "createdDate": "2023-02-14T17:09:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroupResources", "Resource": "*" }, { "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "resource-groups.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/AWSNetworkFirewallManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSNetworkFirewallManaged": "true" } } } ] } }, "v1": { "createdDate": "2020-11-17T17:17:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/AWSNetworkFirewallManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSNetworkFirewallManaged": "true" } } } ] } } }, "createdDate": "2020-11-17T17:17:26.000Z", "lastUpdatedDate": "2023-03-30T17:19:09.000Z" }, "AWSLambda_ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-11-17T21:10:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "logs:DescribeLogGroups", "lambda:Get*", "lambda:List*", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } }, "v2": { "createdDate": "2023-07-27T17:32:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "logs:DescribeLogGroups", "lambda:Get*", "lambda:List*", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", "logs:StartQuery", "logs:StopQuery", "logs:DescribeQueries", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } }, "v3": { "createdDate": "2020-11-17T21:10:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "logs:DescribeLogGroups", "lambda:Get*", "lambda:List*", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", "logs:StartQuery", "logs:StopQuery", "logs:DescribeQueries", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:StartLiveTail", "logs:StopLiveTail" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } } }, "createdDate": "2020-11-17T21:10:32.000Z", "lastUpdatedDate": "2025-03-17T21:07:06.000Z" }, "AWSLambda_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-11-17T21:14:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "lambda:*", "logs:DescribeLogGroups", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } }, "v2": { "createdDate": "2020-11-17T21:14:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "lambda:*", "logs:DescribeLogGroups", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } } }, "createdDate": "2020-11-17T21:14:08.000Z", "lastUpdatedDate": "2025-03-17T21:37:06.000Z" }, "AmazonHoneycodeServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonHoneycodeServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-18T18:03:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sso:GetManagedApplicationInstance" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2020-11-18T18:03:08.000Z", "lastUpdatedDate": "2020-11-18T18:03:08.000Z" }, "S3StorageLensServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/S3StorageLensServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-18T18:15:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-11-18T18:15:40.000Z", "lastUpdatedDate": "2020-11-18T18:15:40.000Z" }, "AWSGlueSchemaRegistryFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSGlueSchemaRegistryFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-20T00:19:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGlueSchemaRegistryFullAccess", "Effect": "Allow", "Action": [ "glue:CreateRegistry", "glue:UpdateRegistry", "glue:DeleteRegistry", "glue:GetRegistry", "glue:ListRegistries", "glue:CreateSchema", "glue:UpdateSchema", "glue:DeleteSchema", "glue:GetSchema", "glue:ListSchemas", "glue:RegisterSchemaVersion", "glue:DeleteSchemaVersions", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:ListSchemaVersions", "glue:CheckSchemaVersionValidity", "glue:PutSchemaVersionMetadata", "glue:RemoveSchemaVersionMetadata", "glue:QuerySchemaVersionMetadata" ], "Resource": [ "*" ] }, { "Sid": "AWSGlueSchemaRegistryTagsFullAccess", "Effect": "Allow", "Action": [ "glue:GetTags", "glue:TagResource", "glue:UnTagResource" ], "Resource": [ "arn:aws:glue:*:*:schema/*", "arn:aws:glue:*:*:registry/*" ] } ] } } }, "createdDate": "2020-11-20T00:19:00.000Z", "lastUpdatedDate": "2020-11-20T00:19:00.000Z" }, "AWSGlueSchemaRegistryReadonlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSGlueSchemaRegistryReadonlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-20T00:20:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGlueSchemaRegistryReadonlyAccess", "Effect": "Allow", "Action": [ "glue:GetRegistry", "glue:ListRegistries", "glue:GetSchema", "glue:ListSchemas", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:ListSchemaVersions", "glue:GetSchemaVersionsDiff", "glue:CheckSchemaVersionValidity", "glue:QuerySchemaVersionMetadata", "glue:GetTags" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-11-20T00:20:06.000Z", "lastUpdatedDate": "2020-11-20T00:20:06.000Z" }, "AmazonConnect_FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonConnect_FullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-11-20T19:54:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*", "ds:CreateAlias", "ds:AuthorizeApplication", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:UnauthorizeApplication", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "kinesis:DescribeStream", "kinesis:ListStreams", "kms:DescribeKey", "kms:ListAliases", "lex:GetBots", "logs:CreateLogGroup", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "lambda:ListFunctions", "ds:CheckAlias" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::amazon-connect-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "arn:aws:servicequotas:*:*:connect/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "connect.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:DeleteServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect*" } ] } }, "v3": { "createdDate": "2021-11-23T22:05:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*", "ds:CreateAlias", "ds:AuthorizeApplication", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:UnauthorizeApplication", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "kinesis:DescribeStream", "kinesis:ListStreams", "kms:DescribeKey", "kms:ListAliases", "lex:GetBots", "lex:ListBots", "lex:ListBotAliases", "logs:CreateLogGroup", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "lambda:ListFunctions", "ds:CheckAlias", "profile:ListAccountIntegrations", "profile:GetDomain", "profile:ListDomains", "profile:GetProfileObjectType", "profile:ListProfileObjectTypeTemplates" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:AddProfileKey", "profile:CreateDomain", "profile:CreateProfile", "profile:DeleteDomain", "profile:DeleteIntegration", "profile:DeleteProfile", "profile:DeleteProfileKey", "profile:DeleteProfileObject", "profile:DeleteProfileObjectType", "profile:GetIntegration", "profile:GetMatches", "profile:GetProfileObjectType", "profile:ListIntegrations", "profile:ListProfileObjects", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "profile:MergeProfiles", "profile:PutIntegration", "profile:PutProfileObject", "profile:PutProfileObjectType", "profile:SearchProfiles", "profile:TagResource", "profile:UntagResource", "profile:UpdateDomain", "profile:UpdateProfile" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::amazon-connect-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "arn:aws:servicequotas:*:*:connect/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "connect.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:DeleteServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect*" } ] } }, "v2": { "createdDate": "2021-07-01T18:41:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*", "ds:CreateAlias", "ds:AuthorizeApplication", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:UnauthorizeApplication", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "kinesis:DescribeStream", "kinesis:ListStreams", "kms:DescribeKey", "kms:ListAliases", "lex:GetBots", "lex:ListBots", "lex:ListBotAliases", "logs:CreateLogGroup", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "lambda:ListFunctions", "ds:CheckAlias" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::amazon-connect-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "arn:aws:servicequotas:*:*:connect/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "connect.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:DeleteServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect*" } ] } }, "v4": { "createdDate": "2023-03-07T14:49:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:*", "ds:CreateAlias", "ds:AuthorizeApplication", "ds:CreateIdentityPoolDirectory", "ds:DeleteDirectory", "ds:DescribeDirectories", "ds:UnauthorizeApplication", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "kinesis:DescribeStream", "kinesis:ListStreams", "kms:DescribeKey", "kms:ListAliases", "lex:GetBots", "lex:ListBots", "lex:ListBotAliases", "logs:CreateLogGroup", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "lambda:ListFunctions", "ds:CheckAlias", "profile:ListAccountIntegrations", "profile:GetDomain", "profile:ListDomains", "profile:GetProfileObjectType", "profile:ListProfileObjectTypeTemplates" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "profile:AddProfileKey", "profile:CreateDomain", "profile:CreateProfile", "profile:DeleteDomain", "profile:DeleteIntegration", "profile:DeleteProfile", "profile:DeleteProfileKey", "profile:DeleteProfileObject", "profile:DeleteProfileObjectType", "profile:GetIntegration", "profile:GetMatches", "profile:GetProfileObjectType", "profile:ListIntegrations", "profile:ListProfileObjects", "profile:ListProfileObjectTypes", "profile:ListTagsForResource", "profile:MergeProfiles", "profile:PutIntegration", "profile:PutProfileObject", "profile:PutProfileObjectType", "profile:SearchProfiles", "profile:TagResource", "profile:UntagResource", "profile:UpdateDomain", "profile:UpdateProfile" ], "Resource": "arn:aws:profile:*:*:domains/amazon-connect-*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::amazon-connect-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "arn:aws:servicequotas:*:*:connect/*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "connect.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:DeleteServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/profile.amazonaws.com/*", "Condition": { "StringEquals": { "iam:AWSServiceName": "profile.amazonaws.com" } } } ] } } }, "createdDate": "2020-11-20T19:54:21.000Z", "lastUpdatedDate": "2023-03-07T14:49:25.000Z" }, "AmazonMWAAServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonMWAAServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-11-24T14:13:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:airflow-*:*" }, { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "AmazonMWAAManaged" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/AmazonMWAAManaged": false } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "AmazonMWAAManaged" } } } ] } }, "v2": { "createdDate": "2022-11-17T00:56:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group:airflow-*:*" }, { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "AmazonMWAAManaged" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/AmazonMWAAManaged": false } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "AmazonMWAAManaged" } } }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/MWAA" ] } } } ] } } }, "createdDate": "2020-11-24T14:13:41.000Z", "lastUpdatedDate": "2022-11-17T00:56:25.000Z" }, "CloudWatchApplicationInsightsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchApplicationInsightsFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-11-24T18:44:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-10-18T17:48:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "sqs:ListQueues", "elasticloadbalancing:DescribeLoadBalancers", "autoscaling:DescribeAutoScalingGroups", "lambda:ListFunctions", "dynamodb:ListTables", "s3:ListAllMyBuckets", "sns:ListTopics", "states:ListStateMachines", "apigateway:GET", "ecs:ListClusters", "ecs:DescribeTaskDefinition", "ecs:ListServices", "ecs:ListTasks", "eks:ListClusters", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-01-25T17:51:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "sqs:ListQueues", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "autoscaling:DescribeAutoScalingGroups", "lambda:ListFunctions", "dynamodb:ListTables", "s3:ListAllMyBuckets", "sns:ListTopics", "states:ListStateMachines", "apigateway:GET", "ecs:ListClusters", "ecs:DescribeTaskDefinition", "ecs:ListServices", "ecs:ListTasks", "eks:ListClusters", "eks:ListNodegroups", "fsx:DescribeFileSystems", "logs:DescribeLogGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2021-11-04T17:13:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "sqs:ListQueues", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "autoscaling:DescribeAutoScalingGroups", "lambda:ListFunctions", "dynamodb:ListTables", "s3:ListAllMyBuckets", "sns:ListTopics", "states:ListStateMachines", "apigateway:GET", "ecs:ListClusters", "ecs:DescribeTaskDefinition", "ecs:ListServices", "ecs:ListTasks", "eks:ListClusters", "eks:ListNodegroups", "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "application-insights.amazonaws.com" } } } ] } } }, "createdDate": "2020-11-24T18:44:14.000Z", "lastUpdatedDate": "2022-01-25T17:51:29.000Z" }, "CloudWatchApplicationInsightsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchApplicationInsightsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-11-24T18:48:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "applicationinsights:Describe*", "applicationinsights:List*" ], "Resource": "*" } ] } } }, "createdDate": "2020-11-24T18:48:00.000Z", "lastUpdatedDate": "2020-11-24T18:48:00.000Z" }, "ElementalSupportCenterFullAccess": { "arn": "arn:aws:iam::aws:policy/ElementalSupportCenterFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-02-05T21:02:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-support-cases:*", "elemental-support-content:*", "elemental-activations:CompleteAccountRegistration" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-11-25T18:08:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elemental-support-cases:*", "elemental-support-content:*" ], "Resource": "*" } ] } } }, "createdDate": "2020-11-25T18:08:30.000Z", "lastUpdatedDate": "2021-02-05T21:02:54.000Z" }, "AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2020-11-27T18:48:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ], "Effect": "Allow" }, { "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ], "Effect": "Allow" }, { "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ], "Effect": "Allow" }, { "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ], "Effect": "Allow" }, { "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ], "Effect": "Allow" }, { "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ], "Effect": "Allow" } ] } }, "v4": { "createdDate": "2022-02-16T19:52:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2021-09-15T20:00:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ], "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2022-03-21T17:33:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-07-02T06:13:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2022-07-14T19:36:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": "lambda:TagResource", "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v7": { "createdDate": "2022-08-02T19:12:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": "lambda:TagResource", "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2020-11-27T18:48:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", "Effect": "Allow", "Action": [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false" } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodePipelinePermission", "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCIAMUserPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCIAMPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogECRPermission", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogEventBridgePermission", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogFirehosePermission", "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogGluePermission", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueClassiferPermission", "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueWorkflowPermission", "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueJobPermission", "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueCrawlerPermission", "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueTriggerPermission", "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaPermission", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaTagPermission", "Effect": "Allow", "Action": "lambda:TagResource", "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogLogGroupPermission", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadPermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadSagemakerResourcePermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3MutatePermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerTagPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerImagePermission", "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Sid": "AmazonSageMakerServiceCatalogStepFunctionPermission", "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeStarPermission", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" }, "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } }, { "Sid": "AmazonSageMakerServiceCatalogCodeConnectionPermission", "Effect": "Allow", "Action": "codeconnections:PassConnection", "Resource": "arn:aws:codeconnections:*:*:connection/*", "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" }, "StringEquals": { "codeconnections:PassedToService": "codepipeline.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2020-11-27T18:48:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", "Effect": "Allow", "Action": [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false" } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodePipelinePermission", "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCIAMUserPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCIAMPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogECRPermission", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogEventBridgePermission", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogFirehosePermission", "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogGluePermission", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueClassiferPermission", "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueWorkflowPermission", "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueJobPermission", "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueCrawlerPermission", "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueTriggerPermission", "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaPermission", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaTagPermission", "Effect": "Allow", "Action": "lambda:TagResource", "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogLogGroupPermission", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadPermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadSagemakerResourcePermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3MutatePermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerTagPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerImagePermission", "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Sid": "AmazonSageMakerServiceCatalogStepFunctionPermission", "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeStarPermission", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } }, { "Sid": "AmazonSageMakerServiceCatalogCodeConnectionPermission", "Effect": "Allow", "Action": "codeconnections:PassConnection", "Resource": "arn:aws:codeconnections:*:*:connection/*", "Condition": { "StringEquals": { "codeconnections:PassedToService": "codepipeline.amazonaws.com" } } } ] } } }, "createdDate": "2020-11-27T18:48:07.000Z", "lastUpdatedDate": "2024-07-01T07:33:43.000Z" }, "AmazonDevOpsGuruServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonDevOpsGuruServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2020-12-01T10:24:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } } ] } }, "v2": { "createdDate": "2021-04-21T23:51:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } } ] } }, "v3": { "createdDate": "2021-11-01T23:24:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } } ] } }, "v5": { "createdDate": "2021-11-24T01:23:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "rds:DescribeDBInstances", "pi:GetResourceMetrics", "tag:GetResources", "lambda:GetFunction", "lambda:GetFunctionConcurrency", "lambda:GetAccountSettings", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "ec2:DescribeSubnets", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "sqs:GetQueueAttributes", "kinesis:DescribeStream", "kinesis:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeLimits", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeStream", "dynamodb:ListStreams", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } } ] } }, "v4": { "createdDate": "2021-11-15T23:26:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "rds:DescribeDBInstances", "pi:GetResourceMetrics" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } } ] } }, "v7": { "createdDate": "2022-07-08T18:03:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "pi:GetResourceMetrics", "tag:GetResources", "lambda:GetFunction", "lambda:GetFunctionConcurrency", "lambda:GetAccountSettings", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "ec2:DescribeSubnets", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "sqs:GetQueueAttributes", "kinesis:DescribeStream", "kinesis:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeLimits", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeStream", "dynamodb:ListStreams", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeOptionGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeAccountAttributes", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } }, { "Sid": "AllowCreateManagedRule", "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowAccessManagedRule", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowOtherOperationsOnManagedRule", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:EnableRule", "events:DisableRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*", "Condition": { "StringEquals": { "events:ManagedBy": "devops-guru.amazonaws.com" } } }, { "Sid": "AllowTagBasedFilterLogEvents", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } } ] } }, "v6": { "createdDate": "2022-02-07T19:30:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "pi:GetResourceMetrics", "tag:GetResources", "lambda:GetFunction", "lambda:GetFunctionConcurrency", "lambda:GetAccountSettings", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "ec2:DescribeSubnets", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "sqs:GetQueueAttributes", "kinesis:DescribeStream", "kinesis:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeLimits", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeStream", "dynamodb:ListStreams", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeOptionGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeAccountAttributes" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } }, { "Sid": "AllowCreateManagedRule", "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowAccessManagedRule", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowOtherOperationsOnManagedRule", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:EnableRule", "events:DisableRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*", "Condition": { "StringEquals": { "events:ManagedBy": "devops-guru.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2022-10-19T08:43:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "pi:GetResourceMetrics", "tag:GetResources", "lambda:GetFunction", "lambda:GetFunctionConcurrency", "lambda:GetAccountSettings", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "ec2:DescribeSubnets", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "sqs:GetQueueAttributes", "kinesis:DescribeStream", "kinesis:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeLimits", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeStream", "dynamodb:ListStreams", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeOptionGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeAccountAttributes", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketWebsite", "s3:GetIntelligentTieringConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListStorageLensConfigurations", "servicequotas:GetServiceQuota", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } }, { "Sid": "AllowCreateManagedRule", "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowAccessManagedRule", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowOtherOperationsOnManagedRule", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:EnableRule", "events:DisableRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*", "Condition": { "StringEquals": { "events:ManagedBy": "devops-guru.amazonaws.com" } } }, { "Sid": "AllowTagBasedFilterLogEvents", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } }, { "Sid": "AllowAPIGatewayGetIntegrations", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration" ] } ] } }, "v9": { "createdDate": "2023-01-10T14:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups", "cloudtrail:LookupEvents", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", "cloudwatch:DescribeAlarms", "cloudwatch:ListDashboards", "cloudwatch:GetDashboard", "cloudformation:GetTemplate", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:ListImports", "codedeploy:BatchGetDeployments", "codedeploy:GetDeploymentGroup", "codedeploy:ListDeployments", "config:DescribeConfigurationRecorderStatus", "config:GetResourceConfigHistory", "events:ListRuleNamesByTarget", "xray:GetServiceGraph", "organizations:ListRoots", "organizations:ListChildren", "organizations:ListDelegatedAdministrators", "pi:GetResourceMetrics", "tag:GetResources", "lambda:GetFunction", "lambda:GetFunctionConcurrency", "lambda:GetAccountSettings", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "ec2:DescribeSubnets", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "sqs:GetQueueAttributes", "kinesis:DescribeStream", "kinesis:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:DescribeLimits", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeStream", "dynamodb:ListStreams", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeOptionGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeAccountAttributes", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "s3:GetBucketNotification", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketWebsite", "s3:GetIntelligentTieringConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListStorageLensConfigurations", "servicequotas:GetServiceQuota", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas" ], "Resource": "*" }, { "Sid": "AllowPutTargetsOnASpecificRule", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*" }, { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Sid": "AllowAddTagsToOpsItem", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true" } } }, { "Sid": "AllowCreateManagedRule", "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowAccessManagedRule", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*" }, { "Sid": "AllowOtherOperationsOnManagedRule", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:EnableRule", "events:DisableRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*", "Condition": { "StringEquals": { "events:ManagedBy": "devops-guru.amazonaws.com" } } }, { "Sid": "AllowTagBasedFilterLogEvents", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } }, { "Sid": "AllowAPIGatewayGetIntegrations", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis/??????????", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration" ] } ] } } }, "createdDate": "2020-12-01T10:24:42.000Z", "lastUpdatedDate": "2023-01-10T14:36:48.000Z" }, "AWSPanoramaGreengrassGroupRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSPanoramaGreengrassGroupRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-01-06T19:30:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaS3Access", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucket*", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*aws-panorama*" ] }, { "Sid": "PanoramaCLoudWatchPutDashboard", "Effect": "Allow", "Action": "cloudwatch:PutDashboard", "Resource": [ "arn:aws:cloudwatch::*:dashboard/panorama*" ] }, { "Sid": "PanoramaCloudWatchPutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" }, { "Sid": "PanoramaGreenGrassCloudWatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/greengrass/*" }, { "Sid": "PanoramaAccess", "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": [ "*" ] } ] } }, "v1": { "createdDate": "2020-12-01T13:10:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaS3Access", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucket*", "s3:HeadBucket", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*aws-panorama*" ] }, { "Sid": "PanoramaCLoudWatchPutDashboard", "Effect": "Allow", "Action": "cloudwatch:PutDashboard", "Resource": [ "arn:aws:cloudwatch::*:dashboard/panorama*" ] }, { "Sid": "PanoramaCloudWatchPutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" }, { "Sid": "PanoramaGreenGrassCloudWatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/greengrass/*" }, { "Sid": "PanoramaAccess", "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-12-01T13:10:22.000Z", "lastUpdatedDate": "2021-01-06T19:30:35.000Z" }, "AWSPanoramaFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPanoramaFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2020-12-01T13:12:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "panorama:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2021-10-20T12:14:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama-*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:panorama*", "arn:aws:secretsmanager:*:*:secret:Panorama*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "panorama.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "panorama.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-01-12T21:21:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:panorama*", "arn:aws:secretsmanager:*:*:secret:Panorama*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "panorama.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "panorama.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2021-10-28T15:37:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:panorama*", "arn:aws:secretsmanager:*:*:secret:Panorama*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "panorama.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "panorama.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2020-12-01T13:12:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "panorama:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject", "s3:GetObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "ArnLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:panorama*", "arn:aws:secretsmanager:*:*:secret:Panorama*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "panorama.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "panorama.amazonaws.com" } } } ] } } }, "createdDate": "2020-12-01T13:12:47.000Z", "lastUpdatedDate": "2024-12-10T20:36:08.000Z" }, "AWSPanoramaApplianceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSPanoramaApplianceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T13:13:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaDeviceCreateLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*" }, { "Sid": "PanoramaDeviceCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/panorama_device*" } ] } } }, "createdDate": "2020-12-01T13:13:18.000Z", "lastUpdatedDate": "2020-12-01T13:13:18.000Z" }, "AWSPanoramaSageMakerRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSPanoramaSageMakerRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T13:13:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaSageMakerS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:GetBucket*" ], "Resource": [ "arn:aws:s3:::*aws-panorama*" ] } ] } } }, "createdDate": "2020-12-01T13:13:54.000Z", "lastUpdatedDate": "2020-12-01T13:13:54.000Z" }, "AWSPanoramaServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSPanoramaServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T13:14:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/panorama*" ] }, { "Sid": "PanoramaIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:AttachPrincipalPolicy", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/panorama*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "PanoramaIoTCreateCertificateAndPolicyAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:CreatePolicy" ], "Resource": [ "*" ] }, { "Sid": "PanoramaIoTCreatePolicyVersionAccess", "Effect": "Allow", "Action": [ "iot:CreatePolicyVersion" ], "Resource": [ "arn:aws:iot:*:*:policy/panorama*" ] }, { "Sid": "PanoramaIoTJobAccess", "Effect": "Allow", "Action": [ "iot:DescribeJobExecution", "iot:CreateJob", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:job/panorama*", "arn:aws:iot:*:*:thing/panorama*" ] }, { "Sid": "PanoramaIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "PanoramaAccess", "Effect": "Allow", "Action": [ "panorama:Describe*", "panorama:List*", "panorama:Get*" ], "Resource": [ "*" ] }, { "Sid": "PanoramaS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:DeleteBucket", "s3:ListBucket", "s3:GetBucket*", "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::*aws-panorama*" ] }, { "Sid": "PanoramaIAMPassSageMakerRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPanoramaSageMakerRole", "arn:aws:iam::*:role/service-role/AWSPanoramaSageMakerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com" ] } } }, { "Sid": "PanoramaIAMPassGreengrassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPanoramaGreengrassGroupRole", "arn:aws:iam::*:role/service-role/AWSPanoramaGreengrassGroupRole", "arn:aws:iam::*:role/AWSPanoramaGreengrassRole", "arn:aws:iam::*:role/service-role/AWSPanoramaGreengrassRole" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "greengrass.amazonaws.com" ] } } }, { "Sid": "PanoramaIAMPassIoTRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWSPanoramaApplianceRole", "arn:aws:iam::*:role/service-role/AWSPanoramaApplianceRole" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "iot.amazonaws.com" } } }, { "Sid": "PanoramaGreenGrassAccess", "Effect": "Allow", "Action": [ "greengrass:AssociateRoleToGroup", "greengrass:AssociateServiceRoleToAccount", "greengrass:CreateResourceDefinition", "greengrass:CreateResourceDefinitionVersion", "greengrass:CreateCoreDefinition", "greengrass:CreateCoreDefinitionVersion", "greengrass:CreateDeployment", "greengrass:CreateFunctionDefinition", "greengrass:CreateFunctionDefinitionVersion", "greengrass:CreateGroup", "greengrass:CreateGroupCertificateAuthority", "greengrass:CreateGroupVersion", "greengrass:CreateLoggerDefinition", "greengrass:CreateLoggerDefinitionVersion", "greengrass:CreateSubscriptionDefinition", "greengrass:CreateSubscriptionDefinitionVersion", "greengrass:DeleteCoreDefinition", "greengrass:DeleteFunctionDefinition", "greengrass:DeleteResourceDefinition", "greengrass:DeleteGroup", "greengrass:DeleteLoggerDefinition", "greengrass:DeleteSubscriptionDefinition", "greengrass:DisassociateRoleFromGroup", "greengrass:DisassociateServiceRoleFromAccount", "greengrass:GetAssociatedRole", "greengrass:GetConnectivityInfo", "greengrass:GetCoreDefinition", "greengrass:GetCoreDefinitionVersion", "greengrass:GetDeploymentStatus", "greengrass:GetDeviceDefinition", "greengrass:GetDeviceDefinitionVersion", "greengrass:GetFunctionDefinition", "greengrass:GetFunctionDefinitionVersion", "greengrass:GetGroup", "greengrass:GetGroupCertificateAuthority", "greengrass:GetGroupCertificateConfiguration", "greengrass:GetGroupVersion", "greengrass:GetLoggerDefinition", "greengrass:GetLoggerDefinitionVersion", "greengrass:GetResourceDefinition", "greengrass:GetServiceRoleForAccount", "greengrass:GetSubscriptionDefinition", "greengrass:GetSubscriptionDefinitionVersion", "greengrass:ListCoreDefinitionVersions", "greengrass:ListCoreDefinitions", "greengrass:ListDeployments", "greengrass:ListDeviceDefinitionVersions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitionVersions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroupCertificateAuthorities", "greengrass:ListGroupVersions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitionVersions", "greengrass:ListLoggerDefinitions", "greengrass:ListSubscriptionDefinitionVersions", "greengrass:ListSubscriptionDefinitions", "greengrass:ResetDeployments", "greengrass:UpdateConnectivityInfo", "greengrass:UpdateCoreDefinition", "greengrass:UpdateDeviceDefinition", "greengrass:UpdateFunctionDefinition", "greengrass:UpdateGroup", "greengrass:UpdateGroupCertificateConfiguration", "greengrass:UpdateLoggerDefinition", "greengrass:UpdateSubscriptionDefinition", "greengrass:UpdateResourceDefinition" ], "Resource": [ "*" ] }, { "Sid": "PanoramaLambdaUsersFunctionAccess", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:ListFunctions", "lambda:ListVersionsByFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*" ] }, { "Sid": "PanoramaSageMakerWriteAccess", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:StopTrainingJob", "sagemaker:CreateCompilationJob", "sagemaker:DescribeCompilationJob", "sagemaker:StopCompilationJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/panorama*", "arn:aws:sagemaker:*:*:compilation-job/panorama*" ] }, { "Sid": "PanoramaSageMakerListAccess", "Effect": "Allow", "Action": [ "sagemaker:ListCompilationJobs" ], "Resource": [ "*" ] }, { "Sid": "PanoramaSageMakerReadAccess", "Effect": "Allow", "Action": [ "sagemaker:DescribeTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ] }, { "Sid": "PanoramaCWLogsAccess", "Effect": "Allow", "Action": [ "iot:AttachPolicy", "iot:CreateRoleAlias" ], "Resource": [ "arn:aws:iot:*:*:policy/panorama*", "arn:aws:iot:*:*:rolealias/panorama*" ] } ] } } }, "createdDate": "2020-12-01T13:14:43.000Z", "lastUpdatedDate": "2020-12-01T13:14:43.000Z" }, "AmazonElasticContainerRegistryPublicPowerUser": { "arn": "arn:aws:iam::aws:policy/AmazonElasticContainerRegistryPublicPowerUser", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T16:16:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken", "ecr-public:BatchCheckLayerAvailability", "ecr-public:GetRepositoryPolicy", "ecr-public:DescribeRepositories", "ecr-public:DescribeRegistries", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRegistryCatalogData", "ecr-public:InitiateLayerUpload", "ecr-public:UploadLayerPart", "ecr-public:CompleteLayerUpload", "ecr-public:PutImage" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-01T16:16:54.000Z", "lastUpdatedDate": "2020-12-01T16:16:54.000Z" }, "AmazonSageMakerFeatureStoreAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerFeatureStoreAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-12-01T16:24:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] } ] } }, "v2": { "createdDate": "2021-02-24T02:18:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] } ] } }, "v3": { "createdDate": "2022-12-05T14:19:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*/metadata/*", "arn:aws:s3:::*Sagemaker*/metadata/*", "arn:aws:s3:::*sagemaker*/metadata/*" ] }, { "Effect": "Allow", "Action": [ "glue:GetTable", "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker_featurestore", "arn:aws:glue:*:*:table/sagemaker_featurestore/*" ] } ] } } }, "createdDate": "2020-12-01T16:24:05.000Z", "lastUpdatedDate": "2022-12-05T14:19:58.000Z" }, "AmazonDevOpsGuruReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDevOpsGuruReadOnlyAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2020-12-01T16:34:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-03-04T02:37:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-06-14T22:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-04-23T18:44:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-11-26T21:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-08-25T18:11:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruReadOnlyAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeAccountHealth", "devops-guru:DescribeAccountOverview", "devops-guru:DescribeAnomaly", "devops-guru:DescribeEventSourcesConfig", "devops-guru:DescribeFeedback", "devops-guru:DescribeInsight", "devops-guru:DescribeResourceCollectionHealth", "devops-guru:DescribeServiceIntegration", "devops-guru:GetCostEstimation", "devops-guru:GetResourceCollection", "devops-guru:ListAnomaliesForInsight", "devops-guru:ListEvents", "devops-guru:ListInsights", "devops-guru:ListAnomalousLogGroups", "devops-guru:ListMonitoredResources", "devops-guru:ListNotificationChannels", "devops-guru:ListRecommendations", "devops-guru:SearchInsights", "devops-guru:StartCostEstimation" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "CloudWatchLogsFilterLogEventsAccess", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } } ] } } }, "createdDate": "2020-12-01T16:34:40.000Z", "lastUpdatedDate": "2022-08-25T18:11:21.000Z" }, "AmazonDevOpsGuruFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDevOpsGuruFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-12-01T16:38:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruFullAccess", "Effect": "Allow", "Action": [ "devops-guru:*" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "SnsListTopicsAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "SnsTopicOperations", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Publish" ], "Resource": "arn:aws:sns:*:*:DevOps-Guru-*" }, { "Sid": "DevOpsGuruSlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru", "Condition": { "StringLike": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "DevOpsGuruSlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" } ] } }, "v2": { "createdDate": "2021-11-26T20:39:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruFullAccess", "Effect": "Allow", "Action": [ "devops-guru:*" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "SnsListTopicsAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "SnsTopicOperations", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Publish" ], "Resource": "arn:aws:sns:*:*:DevOps-Guru-*" }, { "Sid": "DevOpsGuruSlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru", "Condition": { "StringLike": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "DevOpsGuruSlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-08-25T18:23:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruFullAccess", "Effect": "Allow", "Action": [ "devops-guru:*" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "SnsListTopicsAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "SnsTopicOperations", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Publish" ], "Resource": "arn:aws:sns:*:*:DevOps-Guru-*" }, { "Sid": "DevOpsGuruSlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru", "Condition": { "StringLike": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "DevOpsGuruSlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "CloudWatchLogsFilterLogEventsAccess", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } } ] } } }, "createdDate": "2020-12-01T16:38:12.000Z", "lastUpdatedDate": "2022-08-25T18:23:41.000Z" }, "AmazonElasticContainerRegistryPublicFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonElasticContainerRegistryPublicFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T17:25:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr-public:*", "sts:GetServiceBearerToken" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-01T17:25:52.000Z", "lastUpdatedDate": "2020-12-01T17:25:52.000Z" }, "AmazonElasticContainerRegistryPublicReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-01T17:27:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken", "ecr-public:BatchCheckLayerAvailability", "ecr-public:GetRepositoryPolicy", "ecr-public:DescribeRepositories", "ecr-public:DescribeRegistries", "ecr-public:DescribeImages", "ecr-public:DescribeImageTags", "ecr-public:GetRepositoryCatalogData", "ecr-public:GetRegistryCatalogData" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-01T17:27:04.000Z", "lastUpdatedDate": "2020-12-01T17:27:04.000Z" }, "AdministratorAccess-Amplify": { "arn": "arn:aws:iam::aws:policy/AdministratorAccess-Amplify", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v3": { "createdDate": "2021-07-26T22:49:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:DeleteFunction", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "amplify:*", "amplifybackend:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" } ] } }, "v1": { "createdDate": "2020-12-01T19:03:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:DeleteFunction", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:PutRecords" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "amplify:CreateApp", "amplify:CreateBackendEnvironment", "amplify:GetApp", "amplify:GetBackendEnvironment", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:CreateBranch", "amplify:GetBranch", "amplify:UpdateApp", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:DeleteBranch", "amplify:DeleteApp", "amplify:DeleteBackendEnvironment", "amplifybackend: *", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-01-13T22:36:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:DeleteFunction", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:PutRecords" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "sts:AssumeRole", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "mobiletargeting:*", "amplify:CreateApp", "amplify:CreateBackendEnvironment", "amplify:GetApp", "amplify:GetBackendEnvironment", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:CreateBranch", "amplify:GetBranch", "amplify:UpdateApp", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplify:DeleteBranch", "amplify:DeleteApp", "amplify:DeleteBackendEnvironment", "amplifybackend:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-09-23T23:12:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:GetLayerVersionByArn", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:InvokeFunction", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-10-13T20:03:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:InvokeFunction", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-11-04T17:51:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2022-04-13T22:42:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:UpdateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "cloudfront:DeleteDistribution", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-12-01T19:07:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2022-08-30T23:24:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:UpdateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "s3:PutEncryptionConfiguration" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "cloudfront:DeleteDistribution", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" }, { "Sid": "AmplifySSRViewLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "arn:aws:logs:*:*:log-group:*" }, { "Sid": "AmplifySSRCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*" }, { "Sid": "AmplifySSRPushLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*:log-stream:*" } ] } }, "v10": { "createdDate": "2023-02-24T20:14:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UntagResource", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:UpdateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UntagResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "es:UpdateElasticsearchDomainConfig", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "polly:DescribeVoices" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "cloudfront:DeleteDistribution", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" }, { "Sid": "AmplifySSRViewLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "arn:aws:logs:*:*:log-group:*" }, { "Sid": "AmplifySSRCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*" }, { "Sid": "AmplifySSRPushLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*:log-stream:*" } ] } }, "v11": { "createdDate": "2023-05-31T17:08:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UntagResource", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:UpdateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UntagResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "es:UpdateElasticsearchDomainConfig", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "polly:DescribeVoices" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyEcrSDKCalls", "Effect": "Allow", "Action": [ "ecr:DescribeRepositories" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "cloudfront:DeleteDistribution", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" }, { "Sid": "AmplifySSRViewLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "arn:aws:logs:*:*:log-group:*" }, { "Sid": "AmplifySSRCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*" }, { "Sid": "AmplifySSRPushLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*:log-stream:*" } ] } }, "v12": { "createdDate": "2020-12-01T19:03:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CLICloudformationPolicy", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:UpdateStack", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackSet", "cloudformation:UpdateStackSet", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*" ] }, { "Sid": "CLIManageviaCFNPolicy", "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:TagRole", "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:DeletePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:UpdateRole", "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:PassRole", "iam:ListPolicyVersions", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:CreateRole", "iam:ListRolePolicies", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary", "appsync:CreateApiKey", "appsync:CreateDataSource", "appsync:CreateFunction", "appsync:CreateResolver", "appsync:CreateType", "appsync:DeleteApiKey", "appsync:DeleteDataSource", "appsync:DeleteFunction", "appsync:DeleteResolver", "appsync:DeleteType", "appsync:GetDataSource", "appsync:GetFunction", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSchemaCreationStatus", "appsync:GetType", "appsync:GraphQL", "appsync:ListApiKeys", "appsync:ListDataSources", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListResolversByFunction", "appsync:ListTypes", "appsync:StartSchemaCreation", "appsync:UntagResource", "appsync:UpdateApiKey", "appsync:UpdateDataSource", "appsync:UpdateFunction", "appsync:UpdateResolver", "appsync:UpdateType", "appsync:TagResource", "appsync:CreateGraphqlApi", "appsync:DeleteGraphqlApi", "appsync:GetGraphqlApi", "appsync:ListTagsForResource", "appsync:UpdateGraphqlApi", "apigateway:DELETE", "apigateway:GET", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:DescribeIdentity", "cognito-identity:DescribeIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:UpdateIdentityPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:ListTagsForResource", "cognito-idp:ListUserPoolClients", "cognito-idp:UpdateUserPoolClient", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-identity:TagResource", "cognito-idp:TagResource", "cognito-idp:UpdateUserPool", "cognito-idp:SetUserPoolMfaConfig", "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:RemovePermission", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "lambda:AddLayerVersionPermission", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:DeleteLayerVersion", "lambda:GetEventSourceMapping", "lambda:GetLayerVersion", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:PublishLayerVersion", "lambda:RemoveLayerVersionPermission", "lambda:UpdateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListStreams", "dynamodb:PutItem", "dynamodb:TagResource", "dynamodb:ListTagsOfResource", "dynamodb:UntagResource", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTimeToLive", "s3:CreateBucket", "s3:ListBucket", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketWebsite", "s3:PutObjectAcl", "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:DeleteCloudFrontOriginAccessIdentity", "cloudfront:DeleteDistribution", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:UpdateCloudFrontOriginAccessIdentity", "cloudfront:UpdateDistribution", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "mobiletargeting:GetApp", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:ListTagsForStream", "kinesis:PutRecords", "es:AddTags", "es:CreateElasticsearchDomain", "es:DeleteElasticsearchDomain", "es:DescribeElasticsearchDomain", "es:UpdateElasticsearchDomainConfig", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "CLISDKCalls", "Effect": "Allow", "Action": [ "appsync:GetIntrospectionSchema", "appsync:GraphQL", "appsync:UpdateApiKey", "appsync:ListApiKeys", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "sts:AssumeRole", "mobiletargeting:*", "cognito-idp:AdminAddUserToGroup", "cognito-idp:AdminCreateUser", "cognito-idp:CreateGroup", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUser", "cognito-idp:ListUsers", "cognito-idp:AdminGetUser", "cognito-idp:ListUsersInGroup", "cognito-idp:AdminDisableUser", "cognito-idp:AdminRemoveUserFromGroup", "cognito-idp:AdminResetUserPassword", "cognito-idp:AdminListGroupsForUser", "cognito-idp:ListGroups", "cognito-idp:AdminListUserAuthEvents", "cognito-idp:AdminDeleteUser", "cognito-idp:AdminConfirmSignUp", "cognito-idp:AdminEnableUser", "cognito-idp:AdminUpdateUserAttributes", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeUserPool", "cognito-idp:DeleteUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:CreateUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:AdminSetUserPassword", "cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients", "cognito-idp:ListIdentityProviders", "cognito-idp:GetUserPoolMfaConfig", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:CreateIdentityPool", "cognito-identity:DeleteIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "dynamodb:DescribeTable", "dynamodb:ListTables", "lambda:GetFunction", "lambda:CreateFunction", "lambda:AddPermission", "lambda:DeleteFunction", "lambda:DeleteLayerVersion", "lambda:InvokeFunction", "lambda:ListLayerVersions", "iam:PutRolePolicy", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:ListPolicyVersions", "iam:ListAttachedRolePolicies", "iam:CreateRole", "iam:PassRole", "iam:ListRolePolicies", "iam:DeleteRolePolicy", "iam:CreatePolicyVersion", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DetachRolePolicy", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "sns:CreateSMSSandboxPhoneNumber", "sns:GetSMSSandboxAccountStatus", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:ListOriginationNumbers", "rekognition:DescribeCollection", "logs:DescribeLogStreams", "logs:GetLogEvents", "lex:GetBot", "lex:GetBuiltinIntent", "lex:GetBuiltinIntents", "lex:GetBuiltinSlotTypes", "cloudformation:GetTemplateSummary", "codecommit:GitPull", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetCloudFrontOriginAccessIdentityConfig", "polly:DescribeVoices" ], "Resource": "*" }, { "Sid": "AmplifySSMCalls", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*" }, { "Sid": "GeoPowerUser", "Effect": "Allow", "Action": [ "geo:*" ], "Resource": "*" }, { "Sid": "AmplifyEcrSDKCalls", "Effect": "Allow", "Action": [ "ecr:DescribeRepositories" ], "Resource": "*" }, { "Sid": "AmplifyStorageSDKCalls", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteBucketWebsite", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetBucketLocation", "s3:GetObject", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketWebsite", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "*" }, { "Sid": "AmplifySSRCalls", "Effect": "Allow", "Action": [ "cloudfront:CreateCloudFrontOriginAccessIdentity", "cloudfront:CreateDistribution", "cloudfront:CreateInvalidation", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListDistributionsByLambdaFunction", "cloudfront:ListDistributionsByWebACLId", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListInvalidations", "cloudfront:ListPublicKeys", "cloudfront:ListStreamingDistributions", "cloudfront:UpdateDistribution", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:ListTagsForResource", "cloudfront:DeleteDistribution", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:PutRolePolicy", "iam:PassRole", "lambda:CreateFunction", "lambda:EnableReplication", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:PublishVersion", "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:ListTags", "lambda:TagResource", "lambda:UntagResource", "route53:ChangeResourceRecordSets", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "s3:CreateBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:ListBucket", "s3:PutAccelerateConfiguration", "s3:PutBucketPolicy", "s3:PutObject", "s3:PutBucketTagging", "s3:GetBucketTagging", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "iam:UpdateAssumeRolePolicy", "iam:DeleteRolePolicy", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes", "amplify:GetApp", "amplify:GetBranch", "amplify:UpdateApp", "amplify:UpdateBranch" ], "Resource": "*" }, { "Sid": "AmplifySSRViewLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "arn:aws:logs:*:*:log-group:*" }, { "Sid": "AmplifySSRCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*" }, { "Sid": "AmplifySSRPushLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/amplify/*:log-stream:*" } ] } } }, "createdDate": "2020-12-01T19:03:08.000Z", "lastUpdatedDate": "2024-04-04T20:35:31.000Z" }, "AWSServiceRoleForMonitronPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForMonitronPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2022-09-29T20:38:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:GetProfile", "sso:ListProfiles", "sso:ListProfileAssociations", "sso:AssociateProfile", "sso:ListDirectoryAssociations", "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-12-02T19:06:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sso:GetManagedApplicationInstance", "sso:GetProfile", "sso:ListProfiles", "sso:AssociateProfile", "sso:ListDirectoryAssociations", "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": "*", "Effect": "Allow" } ] } }, "v3": { "createdDate": "2020-12-02T19:06:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:GetProfile", "sso:ListProfiles", "sso:ListProfileAssociations", "sso:AssociateProfile", "sso:ListDirectoryAssociations", "sso-directory:DescribeUsers", "sso-directory:SearchUsers", "sso:CreateApplicationAssignment", "sso:ListApplicationAssignments" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-02T19:06:08.000Z", "lastUpdatedDate": "2024-10-02T10:06:59.000Z" }, "AmazonMonitronFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMonitronFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-12-02T22:40:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "monitron.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "monitron:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "monitron.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "AWSSSOPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-06-08T16:27:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "monitron.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "monitron:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "monitron.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "AWSSSOPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "ds:DescribeDirectories", "ds:DescribeTrusts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:ListStreams" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/monitron/*" } ] } } }, "createdDate": "2020-12-02T22:40:28.000Z", "lastUpdatedDate": "2022-06-08T16:27:42.000Z" }, "AWSMarketplaceLicenseManagementServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-03T08:33:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowLicenseManagerActions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "license-manager:ListReceivedGrants", "license-manager:ListDistributedGrants", "license-manager:GetGrant", "license-manager:CreateGrant", "license-manager:CreateGrantVersion", "license-manager:DeleteGrant", "license-manager:AcceptGrant" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2020-12-03T08:33:40.000Z", "lastUpdatedDate": "2020-12-03T08:33:40.000Z" }, "AWSGlueDataBrewServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSGlueDataBrewServiceRole", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-12-04T21:26:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetConnection" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:CreateNetworkInterface" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Condition": { "StringLike": { "aws:ResourceTag/aws-glue-service-resource": "*" } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws-glue-databrew/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-18T19:44:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetConnection" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:CreateNetworkInterface" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Condition": { "StringLike": { "aws:ResourceTag/aws-glue-service-resource": "*" } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws-glue-databrew/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*" } ] } }, "v3": { "createdDate": "2022-05-09T23:06:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetConnection" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:BatchGetCustomEntityTypes" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:CreateNetworkInterface" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Condition": { "StringLike": { "aws:ResourceTag/aws-glue-service-resource": "*" } }, "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws-glue-databrew/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*" } ] } }, "v4": { "createdDate": "2020-12-04T21:26:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueDataPermissions", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetConnection" ], "Resource": [ "*" ] }, { "Sid": "GluePIIPermissions", "Effect": "Allow", "Action": [ "glue:BatchGetCustomEntityTypes", "glue:GetCustomEntityType" ], "Resource": [ "*" ] }, { "Sid": "S3PublicDatasetAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::databrew-public-datasets-*" ] }, { "Sid": "EC2NetworkingPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeRouteTables", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:CreateNetworkInterface" ], "Resource": [ "*" ] }, { "Sid": "EC2DeleteGlueNetworkInterfacePermissions", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Condition": { "StringLike": { "aws:ResourceTag/aws-glue-service-resource": "*" } }, "Resource": [ "*" ] }, { "Sid": "EC2GlueTaggingPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "GlueDatabrewLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws-glue-databrew/*" ] }, { "Sid": "LakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:databrew!default-*" } ] } } }, "createdDate": "2020-12-04T21:26:50.000Z", "lastUpdatedDate": "2024-03-20T23:28:52.000Z" }, "ECRReplicationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ECRReplicationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-04T22:11:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:ReplicateImage" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-04T22:11:28.000Z", "lastUpdatedDate": "2020-12-04T22:11:28.000Z" }, "IVSRecordToS3": { "arn": "arn:aws:iam::aws:policy/aws-service-role/IVSRecordToS3", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-05T00:10:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::AWSIVS_*/ivs/*" ] } ] } } }, "createdDate": "2020-12-05T00:10:43.000Z", "lastUpdatedDate": "2020-12-05T00:10:43.000Z" }, "AWSSystemsManagerChangeManagementServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSystemsManagerChangeManagementServicePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-07T22:21:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation", "ssm:CreateOpsItem", "ssm:GetOpsItem", "ssm:UpdateOpsItem", "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "ssm:GetAutomationExecution", "ssm:GetCalendarState", "ssm:GetDocument" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:ListDirectoryAssociations" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:IsMemberInGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:GetGroup", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-12-07T22:21:57.000Z", "lastUpdatedDate": "2020-12-07T22:21:57.000Z" }, "AWSAuditManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAuditManagerServiceRolePolicy", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListUsageForLicenseConfiguration" ], "Resource": "*", "Sid": "LicenseManagerAccess" }, { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GetAccountSummary", "iam:ListPolicies", "iam:GetAccountPasswordPolicy", "iam:ListUsers", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy" ], "Resource": "*", "Sid": "IAMAccess" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints" ], "Resource": "*", "Sid": "EC2Access" }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails" ], "Resource": "*", "Sid": "CloudtrailAccess" }, { "Effect": "Allow", "Action": [ "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "config:DescribeConfigRules" ], "Resource": "*", "Sid": "ConfigAccess" }, { "Effect": "Allow", "Action": [ "securityhub:DescribeStandards" ], "Resource": "*", "Sid": "SecurityHubAccess" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListGrants" ], "Resource": "*", "Sid": "KMSAccess" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Sid": "CloudwatchAccess" }, { "Effect": "Allow", "Action": [ "s3:GetLifecycleConfiguration" ], "Resource": "*", "Sid": "S3Access" }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*", "Sid": "EventBridgeAccess" }, { "Effect": "Allow", "Action": [ "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "WAFAccess" }, { "Effect": "Allow", "Action": [ "guardduty:ListDetectors" ], "Resource": "*", "Sid": "GuardDutyAccess" }, { "Effect": "Allow", "Action": [ "route53:GetQueryLoggingConfig" ], "Resource": "*", "Sid": "Route53Access" }, { "Effect": "Allow", "Action": [ "organizations:DescribePolicy" ], "Resource": "*", "Sid": "OrganizationsAccess" }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool" ], "Resource": "*", "Sid": "CognitoAccess" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": "*", "Sid": "EFSAccess" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:source": "aws.securityhub", "events:detail-type": "Security Hub Findings - Imported" } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v2": { "createdDate": "2021-11-22T19:36:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListUsageForLicenseConfiguration" ], "Resource": "*", "Sid": "LicenseManagerAccess" }, { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GetAccountSummary", "iam:ListPolicies", "iam:GetAccountPasswordPolicy", "iam:ListUsers", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy" ], "Resource": "*", "Sid": "IAMAccess" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints" ], "Resource": "*", "Sid": "EC2Access" }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails" ], "Resource": "*", "Sid": "CloudtrailAccess" }, { "Effect": "Allow", "Action": [ "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "config:DescribeConfigRules" ], "Resource": "*", "Sid": "ConfigAccess" }, { "Effect": "Allow", "Action": [ "securityhub:DescribeStandards" ], "Resource": "*", "Sid": "SecurityHubAccess" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListGrants" ], "Resource": "*", "Sid": "KMSAccess" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Sid": "CloudwatchAccess" }, { "Effect": "Allow", "Action": [ "s3:GetLifecycleConfiguration" ], "Resource": "*", "Sid": "S3Access" }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*", "Sid": "EventBridgeAccess" }, { "Effect": "Allow", "Action": [ "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "WAFAccess" }, { "Effect": "Allow", "Action": [ "guardduty:ListDetectors" ], "Resource": "*", "Sid": "GuardDutyAccess" }, { "Effect": "Allow", "Action": [ "route53:GetQueryLoggingConfig" ], "Resource": "*", "Sid": "Route53Access" }, { "Effect": "Allow", "Action": [ "organizations:DescribePolicy" ], "Resource": "*", "Sid": "OrganizationsAccess" }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool" ], "Resource": "*", "Sid": "CognitoAccess" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": "*", "Sid": "EFSAccess" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v3": { "createdDate": "2022-05-20T16:26:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListUsageForLicenseConfiguration" ], "Resource": "*", "Sid": "LicenseManagerAccess" }, { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GetAccountSummary", "iam:ListPolicies", "iam:GetAccountPasswordPolicy", "iam:ListUsers", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy" ], "Resource": "*", "Sid": "IAMAccess" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints" ], "Resource": "*", "Sid": "EC2Access" }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails" ], "Resource": "*", "Sid": "CloudtrailAccess" }, { "Effect": "Allow", "Action": [ "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "config:DescribeConfigRules" ], "Resource": "*", "Sid": "ConfigAccess" }, { "Effect": "Allow", "Action": [ "securityhub:DescribeStandards" ], "Resource": "*", "Sid": "SecurityHubAccess" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListGrants" ], "Resource": "*", "Sid": "KMSAccess" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Sid": "CloudwatchAccess" }, { "Effect": "Allow", "Action": [ "s3:GetLifecycleConfiguration" ], "Resource": "*", "Sid": "S3Access" }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*", "Sid": "EventBridgeAccess" }, { "Effect": "Allow", "Action": [ "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "WAFAccess" }, { "Effect": "Allow", "Action": [ "guardduty:ListDetectors" ], "Resource": "*", "Sid": "GuardDutyAccess" }, { "Effect": "Allow", "Action": [ "route53:GetQueryLoggingConfig" ], "Resource": "*", "Sid": "Route53Access" }, { "Effect": "Allow", "Action": [ "organizations:DescribePolicy", "organizations:DescribeOrganization" ], "Resource": "*", "Sid": "OrganizationsAccess" }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool" ], "Resource": "*", "Sid": "CognitoAccess" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": "*", "Sid": "EFSAccess" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v4": { "createdDate": "2022-07-07T22:26:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "license-manager:ListLicenseConfigurations", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListUsageForLicenseConfiguration" ], "Resource": "*", "Sid": "LicenseManagerAccess" }, { "Effect": "Allow", "Action": [ "iam:GenerateCredentialReport", "iam:GetAccountSummary", "iam:ListPolicies", "iam:GetAccountPasswordPolicy", "iam:ListUsers", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListRolePolicies", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy" ], "Resource": "*", "Sid": "IAMAccess" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSnapshots", "ec2:DescribeVpcEndpoints", "ec2:DescribeVolumes" ], "Resource": "*", "Sid": "EC2Access" }, { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails" ], "Resource": "*", "Sid": "CloudtrailAccess" }, { "Effect": "Allow", "Action": [ "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "config:DescribeConfigRules" ], "Resource": "*", "Sid": "ConfigAccess" }, { "Effect": "Allow", "Action": [ "securityhub:DescribeStandards" ], "Resource": "*", "Sid": "SecurityHubAccess" }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:DescribeKey", "kms:ListGrants", "kms:GetKeyRotationStatus", "kms:GetKeyPolicy", "kms:ListKeyPolicies" ], "Resource": "*", "Sid": "KMSAccess" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Sid": "CloudwatchAccess" }, { "Effect": "Allow", "Action": [ "s3:GetLifecycleConfiguration", "s3:GetEncryptionConfiguration", "s3:ListAllMyBuckets" ], "Resource": "*", "Sid": "S3Access" }, { "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*", "Sid": "EventBridgeAccess" }, { "Effect": "Allow", "Action": [ "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "WAFAccess" }, { "Effect": "Allow", "Action": [ "guardduty:ListDetectors" ], "Resource": "*", "Sid": "GuardDutyAccess" }, { "Effect": "Allow", "Action": [ "route53:GetQueryLoggingConfig" ], "Resource": "*", "Sid": "Route53Access" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:ListTables" ], "Resource": "*", "Sid": "DynamoDBAccess" }, { "Effect": "Allow", "Action": [ "redshift:DescribeClusters" ], "Resource": "*", "Sid": "RedshiftAccess" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*", "Sid": "RDSAccess" }, { "Effect": "Allow", "Action": [ "organizations:DescribePolicy", "organizations:DescribeOrganization" ], "Resource": "*", "Sid": "OrganizationsAccess" }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool" ], "Resource": "*", "Sid": "CognitoAccess" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeFileSystems" ], "Resource": "*", "Sid": "EFSAccess" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v5": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListModelCustomizationJobs", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDbClusterEndpoints", "rds:DescribeDbClusterParameterGroups", "rds:DescribeDbClusters", "rds:DescribeDBInstances", "rds:DescribeDbSecurityGroups", "redshift:DescribeClusters", "route53:GetQueryLoggingConfig", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "securityhub:DescribeStandards", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "s2sAPIsAccess" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v6": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListModelCustomizationJobs", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDbClusterEndpoints", "rds:DescribeDbClusterParameterGroups", "rds:DescribeDbClusters", "rds:DescribeDBInstances", "rds:DescribeDbSecurityGroups", "redshift:DescribeClusters", "route53:GetQueryLoggingConfig", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "securityhub:DescribeStandards", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf:ListActivatedRulesInRuleGroup" ], "Resource": "*", "Sid": "AuditManagerAPICallAccess" }, { "Sid": "AuditManagerS3GetBucketPolicyAccess", "Effect": "Allow", "Action": [ "s3:GetBucketPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v7": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListModelCustomizationJobs", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeBackup", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstanceAttribute", "ec2:DescribeSecurityGroupRules", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:GetLaunchTemplateData", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccessKeyLastUsed", "iam:GetCredentialReport", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "iam:ListPolicyVersions", "iam:ListAccessKeys", "iam:ListAttachedRolePolicies", "iam:ListMfaDeviceTags", "iam:ListMfaDevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "es:DescribeDomains", "es:DescribeDomain", "es:DescribeDomainConfig", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeLoggingStatus", "route53:GetQueryLoggingConfig", "sagemaker:ListEndpointConfigs", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "sagemaker:DescribeEndpointConfig", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "securityhub:DescribeStandards", "sns:ListTagsForResource", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetRule", "waf-regional:GetWebAcl", "waf:GetRule", "waf:GetRuleGroup", "waf:ListActivatedRulesInRuleGroup", "waf:ListWebAcls", "wafv2:ListWebAcls", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf-regional:ListRules", "waf:ListRuleGroups", "waf:ListRules" ], "Resource": "*", "Sid": "APIsAccess" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:GetBucketLogging", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketTagging" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v8": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListModelCustomizationJobs", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeBackup", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstanceAttribute", "ec2:DescribeSecurityGroupRules", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:GetLaunchTemplateData", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccessKeyLastUsed", "iam:GetCredentialReport", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:ListAttachedGroupPolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupsForUser", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "iam:ListPolicyVersions", "iam:ListAccessKeys", "iam:ListAttachedRolePolicies", "iam:ListMfaDeviceTags", "iam:ListMfaDevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "es:DescribeDomains", "es:DescribeDomain", "es:DescribeDomainConfig", "es:ListDomainNames", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeLoggingStatus", "route53:GetQueryLoggingConfig", "sagemaker:ListEndpointConfigs", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "sagemaker:DescribeEndpointConfig", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "securityhub:DescribeStandards", "sns:ListTagsForResource", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetRule", "waf-regional:GetWebAcl", "waf:GetRule", "waf:GetRuleGroup", "waf:ListActivatedRulesInRuleGroup", "waf:ListWebAcls", "wafv2:ListWebAcls", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf-regional:ListRules", "waf:ListRuleGroups", "waf:ListRules" ], "Resource": "*", "Sid": "APIsAccess" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:GetBucketLogging", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketTagging" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v9": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListModelCustomizationJobs", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeBackup", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstanceAttribute", "ec2:DescribeSecurityGroupRules", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:GetLaunchTemplateData", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccessKeyLastUsed", "iam:GetCredentialReport", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:ListAttachedGroupPolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupsForUser", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "iam:ListPolicyVersions", "iam:ListAccessKeys", "iam:ListAttachedRolePolicies", "iam:ListMfaDeviceTags", "iam:ListMfaDevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "es:DescribeDomains", "es:DescribeDomain", "es:DescribeDomainConfig", "es:ListDomainNames", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeLoggingStatus", "route53:GetQueryLoggingConfig", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelCard", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeModel", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeUserProfile", "sagemaker:ListAlgorithms", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanTaskUis", "sagemaker:ListLabelingJobs", "sagemaker:ListModels", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelCards", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListMonitoringAlerts", "sagemaker:ListMonitoringSchedules", "sagemaker:ListTrainingJobs", "sagemaker:ListUserProfiles", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "securityhub:DescribeStandards", "sns:ListTagsForResource", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetRule", "waf-regional:GetWebAcl", "waf:GetRule", "waf:GetRuleGroup", "waf:ListActivatedRulesInRuleGroup", "waf:ListWebAcls", "wafv2:ListWebAcls", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf-regional:ListRules", "waf:ListRuleGroups", "waf:ListRules" ], "Resource": "*", "Sid": "APIsAccess" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:GetBucketLogging", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketTagging" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } }, "v10": { "createdDate": "2020-12-08T15:12:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:GetAccountConfiguration", "acm:ListCertificates", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListRecoveryPointsByResource", "bedrock:GetCustomModel", "bedrock:GetFoundationModel", "bedrock:GetModelCustomizationJob", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:ListCustomModels", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListModelCustomizationJobs", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:GetTrail", "cloudtrail:ListTrails", "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cognito-idp:DescribeUserPool", "config:DescribeConfigRules", "config:DescribeDeliveryChannels", "config:ListDiscoveredResources", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeBackup", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTable", "dynamodb:ListBackups", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstanceAttribute", "ec2:DescribeSecurityGroupRules", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:GetLaunchTemplateData", "ec2:DescribeAddresses", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecs:DescribeClusters", "eks:DescribeAddonVersions", "elasticache:DescribeCacheClusters", "elasticache:DescribeServiceUpdates", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSslPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "elasticmapreduce:ListSecurityConfigurations", "events:DescribeRule", "events:ListConnections", "events:ListEventBuses", "events:ListEventSources", "events:ListRules", "firehose:ListDeliveryStreams", "fsx:DescribeFileSystems", "guardduty:ListDetectors", "iam:GenerateCredentialReport", "iam:GetAccountAuthorizationDetails", "iam:GetAccessKeyLastUsed", "iam:GetCredentialReport", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:ListAttachedGroupPolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupsForUser", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListOpenIdConnectProviders", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSamlProviders", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "iam:ListPolicyVersions", "iam:ListAccessKeys", "iam:ListAttachedRolePolicies", "iam:ListMfaDeviceTags", "iam:ListMfaDevices", "kafka:ListClusters", "kafka:ListKafkaVersions", "kinesis:ListStreams", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeys", "lambda:ListFunctions", "license-manager:ListAssociationsForLicenseConfiguration", "license-manager:ListLicenseConfigurations", "license-manager:ListUsageForLicenseConfiguration", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:DescribeMetricFilters", "logs:DescribeResourcePolicies", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "es:DescribeDomains", "es:DescribeDomain", "es:DescribeDomainConfig", "es:ListDomainNames", "organizations:DescribeOrganization", "organizations:DescribePolicy", "rds:DescribeCertificates", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBInstances", "rds:DescribeDBSecurityGroups", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeLoggingStatus", "route53:GetQueryLoggingConfig", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelCard", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeModel", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeUserProfile", "sagemaker:ListAlgorithms", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanTaskUis", "sagemaker:ListLabelingJobs", "sagemaker:ListModels", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelCards", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListMonitoringAlerts", "sagemaker:ListMonitoringSchedules", "sagemaker:ListTrainingJobs", "sagemaker:ListUserProfiles", "s3:GetBucketPublicAccessBlock", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", "securityhub:DescribeStandards", "sns:ListTagsForResource", "sns:ListTopics", "sqs:ListQueues", "waf-regional:GetRule", "waf-regional:GetWebAcl", "waf:GetRule", "waf:GetRuleGroup", "waf:ListActivatedRulesInRuleGroup", "waf:ListWebAcls", "wafv2:ListWebAcls", "waf-regional:GetLoggingConfiguration", "waf-regional:ListRuleGroups", "waf-regional:ListSubscribedRuleGroups", "waf-regional:ListWebACLs", "waf-regional:ListRules", "waf:ListRuleGroups", "waf:ListRules" ], "Resource": "*", "Sid": "APIsAccess" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:GetBucketLogging", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketTagging" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "APIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/restapis/*/stages" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "Null": { "events:source": "false" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" } ] } } }, "createdDate": "2020-12-08T15:12:12.000Z", "lastUpdatedDate": "2024-09-24T23:22:25.000Z" }, "AmazonSageMakerEdgeDeviceFleetPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerEdgeDeviceFleetPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-08T16:17:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeviceS3Access", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "SageMakerEdgeApis", "Effect": "Allow", "Action": [ "sagemaker:SendHeartbeat", "sagemaker:GetDeviceRegistration" ], "Resource": "*" }, { "Sid": "CreateIoTRoleAlias", "Effect": "Allow", "Action": [ "iot:CreateRoleAlias", "iot:DescribeRoleAlias", "iot:UpdateRoleAlias", "iot:ListTagsForResource", "iot:TagResource" ], "Resource": [ "arn:aws:iot:*:*:rolealias/SageMakerEdge*" ] }, { "Sid": "CreateIoTRoleAliasIamPermissionsGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/*SageMaker*", "arn:aws:iam::*:role/*Sagemaker*", "arn:aws:iam::*:role/*sagemaker*" ] }, { "Sid": "CreateIoTRoleAliasIamPermissionsPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*SageMaker*", "arn:aws:iam::*:role/*Sagemaker*", "arn:aws:iam::*:role/*sagemaker*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "iot.amazonaws.com", "credentials.iot.amazonaws.com" ] } } } ] } } }, "createdDate": "2020-12-08T16:17:22.000Z", "lastUpdatedDate": "2020-12-08T16:17:22.000Z" }, "AmazonEMRContainersServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRContainersServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2020-12-09T00:38:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-12-03T19:55:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "acm:ImportCertificate", "acm:AddTagsToCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/emr-container:endpoint:managed-certificate": "true" } } }, { "Effect": "Allow", "Action": [ "acm:DeleteCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/emr-container:endpoint:managed-certificate": "true" } } } ] } }, "v3": { "createdDate": "2023-03-10T22:58:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:ListNodeGroups", "eks:DescribeNodeGroup", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "acm:ImportCertificate", "acm:AddTagsToCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/emr-container:endpoint:managed-certificate": "true" } } }, { "Effect": "Allow", "Action": [ "acm:DeleteCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/emr-container:endpoint:managed-certificate": "true" } } } ] } }, "v4": { "createdDate": "2020-12-09T00:38:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:ListNodeGroups", "eks:DescribeNodeGroup", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "eks:ListPodIdentityAssociations", "eks:DescribePodIdentityAssociation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "acm:ImportCertificate", "acm:AddTagsToCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/emr-container:endpoint:managed-certificate": "true" } } }, { "Effect": "Allow", "Action": [ "acm:DeleteCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/emr-container:endpoint:managed-certificate": "true" } } } ] } } }, "createdDate": "2020-12-09T00:38:19.000Z", "lastUpdatedDate": "2025-02-06T21:07:07.000Z" }, "EC2InstanceProfileForImageBuilderECRContainerBuilds": { "arn": "arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilderECRContainerBuilds", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-11T19:48:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:PutImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:imagebuilder:arn", "aws:CalledVia": [ "imagebuilder.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::ec2imagebuilder*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" } ] } } }, "createdDate": "2020-12-11T19:48:15.000Z", "lastUpdatedDate": "2020-12-11T19:48:15.000Z" }, "AWSAuditManagerAdministratorAccess": { "arn": "arn:aws:iam::aws:policy/AWSAuditManagerAdministratorAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2022-04-30T00:02:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AuditManagerAccess", "Effect": "Allow", "Action": [ "auditmanager:*" ], "Resource": "*" }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": [ "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "AllowOnlyAuditManagerIntegration", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator", "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:ServicePrincipal": [ "auditmanager.amazonaws.com" ] } } }, { "Sid": "IAMAccess", "Effect": "Allow", "Action": [ "iam:GetUser", "iam:ListUsers", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMAccessCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*", "Condition": { "StringLike": { "iam:AWSServiceName": "auditmanager.amazonaws.com" } } }, { "Sid": "IAMAccessManageSLR", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:UpdateRoleDescription", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "KmsAccess", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": "auditmanager.*.amazonaws.com" } } }, { "Sid": "SNSAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" }, { "Sid": "TagAccess", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2020-12-11T20:02:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AuditManagerAccess", "Effect": "Allow", "Action": [ "auditmanager:*" ], "Resource": "*" }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": [ "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "AllowOnlyAuditManagerIntegration", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator", "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:ServicePrincipal": [ "auditmanager.amazonaws.com" ] } } }, { "Sid": "IAMAccess", "Effect": "Allow", "Action": [ "iam:GetUser", "iam:ListUsers", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMAccessCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*", "Condition": { "StringLike": { "iam:AWSServiceName": "auditmanager.amazonaws.com" } } }, { "Sid": "IAMAccessManageSLR", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:UpdateRoleDescription", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "KmsAccess", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": "auditmanager.*.amazonaws.com" } } }, { "Sid": "SNSAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:source": "aws.securityhub", "events:detail-type": "Security Hub Findings - Imported" } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" }, { "Sid": "TagAccess", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2020-12-11T20:02:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AuditManagerAccess", "Effect": "Allow", "Action": [ "auditmanager:*" ], "Resource": "*" }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": [ "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:ListParents", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "AllowOnlyAuditManagerIntegration", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator", "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:ServicePrincipal": [ "auditmanager.amazonaws.com" ] } } }, { "Sid": "IAMAccess", "Effect": "Allow", "Action": [ "iam:GetUser", "iam:ListUsers", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMAccessCreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*", "Condition": { "StringLike": { "iam:AWSServiceName": "auditmanager.amazonaws.com" } } }, { "Sid": "IAMAccessManageSLR", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:UpdateRoleDescription", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/auditmanager.amazonaws.com/AWSServiceRoleForAuditManager*" }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "KmsAccess", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "KmsCreateGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringLike": { "kms:ViaService": "auditmanager.*.amazonaws.com" } } }, { "Sid": "SNSAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "CreateEventsAccess", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "*", "Condition": { "StringEquals": { "events:detail-type": "Security Hub Findings - Imported" }, "ForAllValues:StringEquals": { "events:source": [ "aws.securityhub" ] } } }, { "Sid": "EventsAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:EnableRule", "events:DisableRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver" }, { "Sid": "TagAccess", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "ControlCatalogAccess", "Effect": "Allow", "Action": [ "controlcatalog:ListCommonControls", "controlcatalog:ListDomains", "controlcatalog:ListObjectives" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-11T20:02:42.000Z", "lastUpdatedDate": "2024-05-15T23:46:15.000Z" }, "AWSTransferConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSTransferConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-14T19:33:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "transfer.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "acm:ListCertificates", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "health:DescribeEventAggregates", "iam:GetPolicyVersion", "iam:ListPolicies", "iam:ListRoles", "route53:ListHostedZones", "s3:ListAllMyBuckets", "transfer:*" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-14T19:33:25.000Z", "lastUpdatedDate": "2020-12-14T19:33:25.000Z" }, "AWSTransferFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSTransferFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-14T19:37:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "transfer:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "transfer.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-14T19:37:23.000Z", "lastUpdatedDate": "2020-12-14T19:37:23.000Z" }, "AWSIoTFleetHubFederationAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSIoTFleetHubFederationAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2020-12-15T08:08:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeIndex", "iot:DescribeThingGroup", "iot:GetBucketsAggregation", "iot:GetCardinality", "iot:GetIndexingConfiguration", "iot:GetPercentiles", "iot:GetStatistics", "iot:SearchIndex", "iot:CreateFleetMetric", "iot:ListFleetMetrics", "iot:DeleteFleetMetric", "iot:DescribeFleetMetric", "iot:UpdateFleetMetric", "iotfleethub:ListDashboards", "iotfleethub:DescribeDashboard", "iotfleethub:DescribeApplication", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:iotfleethub*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "arn:aws:cloudwatch:*:*:iotfleethub*" } ] } }, "v2": { "createdDate": "2021-04-12T18:27:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeIndex", "iot:DescribeThingGroup", "iot:GetBucketsAggregation", "iot:GetCardinality", "iot:GetIndexingConfiguration", "iot:GetPercentiles", "iot:GetStatistics", "iot:SearchIndex", "iot:CreateFleetMetric", "iot:ListFleetMetrics", "iot:DeleteFleetMetric", "iot:DescribeFleetMetric", "iot:UpdateFleetMetric", "iotfleethub:DescribeApplication", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:iotfleethub*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "arn:aws:cloudwatch:*:*:iotfleethub*" } ] } }, "v3": { "createdDate": "2021-05-24T14:12:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeIndex", "iot:DescribeThingGroup", "iot:GetBucketsAggregation", "iot:GetCardinality", "iot:GetIndexingConfiguration", "iot:GetPercentiles", "iot:GetStatistics", "iot:SearchIndex", "iot:CreateFleetMetric", "iot:ListFleetMetrics", "iot:DeleteFleetMetric", "iot:DescribeFleetMetric", "iot:UpdateFleetMetric", "iot:ListThingGroups", "iot:ListThingsInThingGroup", "iot:ListJobTemplates", "iot:DescribeJobTemplate", "iot:ListJobs", "iot:CreateJob", "iot:CancelJob", "iot:DescribeJob", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:DescribeJobExecution", "iotfleethub:DescribeApplication", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:iotfleethub*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "arn:aws:cloudwatch:*:*:iotfleethub*" } ] } }, "v4": { "createdDate": "2021-11-15T23:28:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeIndex", "iot:DescribeThingGroup", "iot:GetBucketsAggregation", "iot:GetCardinality", "iot:GetIndexingConfiguration", "iot:GetPercentiles", "iot:GetStatistics", "iot:SearchIndex", "iot:CreateFleetMetric", "iot:ListFleetMetrics", "iot:DeleteFleetMetric", "iot:DescribeFleetMetric", "iot:UpdateFleetMetric", "iot:ListThingGroups", "iot:ListThingsInThingGroup", "iot:ListJobTemplates", "iot:DescribeJobTemplate", "iot:ListJobs", "iot:CreateJob", "iot:CancelJob", "iot:DescribeJob", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:DescribeJobExecution", "iot:ListSecurityProfiles", "iot:DescribeSecurityProfile", "iot:ListActiveViolations", "iot:GetThingShadow", "iot:ListNamedShadowsForThing", "iot:CancelJobExecution", "iot:DescribeEndpoint", "iotfleethub:DescribeApplication", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:iotfleethub*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "arn:aws:cloudwatch:*:*:iotfleethub*" } ] } }, "v5": { "createdDate": "2022-04-04T18:03:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeIndex", "iot:DescribeThingGroup", "iot:GetBucketsAggregation", "iot:GetCardinality", "iot:GetIndexingConfiguration", "iot:GetPercentiles", "iot:GetStatistics", "iot:SearchIndex", "iot:CreateFleetMetric", "iot:ListFleetMetrics", "iot:DeleteFleetMetric", "iot:DescribeFleetMetric", "iot:UpdateFleetMetric", "iot:DescribeCustomMetric", "iot:ListCustomMetrics", "iot:ListDimensions", "iot:ListMetricValues", "iot:ListThingGroups", "iot:ListThingsInThingGroup", "iot:ListJobTemplates", "iot:DescribeJobTemplate", "iot:ListJobs", "iot:CreateJob", "iot:CancelJob", "iot:DescribeJob", "iot:ListJobExecutionsForJob", "iot:ListJobExecutionsForThing", "iot:DescribeJobExecution", "iot:ListSecurityProfiles", "iot:DescribeSecurityProfile", "iot:ListActiveViolations", "iot:GetThingShadow", "iot:ListNamedShadowsForThing", "iot:CancelJobExecution", "iot:DescribeEndpoint", "iotfleethub:DescribeApplication", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "sns:ListTopics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:iotfleethub*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "arn:aws:cloudwatch:*:*:iotfleethub*" } ] } } }, "createdDate": "2020-12-15T08:08:05.000Z", "lastUpdatedDate": "2022-04-04T18:03:01.000Z" }, "AWSIoTWirelessFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:27:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotwireless:*" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T15:27:57.000Z", "lastUpdatedDate": "2020-12-15T15:27:57.000Z" }, "AWSIoTWirelessReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:28:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotwireless:List*", "iotwireless:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T15:28:56.000Z", "lastUpdatedDate": "2020-12-15T15:28:56.000Z" }, "AWSIoTWirelessFullPublishAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessFullPublishAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:29:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:DescribeEndpoint", "iot:Publish" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T15:29:59.000Z", "lastUpdatedDate": "2020-12-15T15:29:59.000Z" }, "AWSIoTWirelessGatewayCertManager": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessGatewayCertManager", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:30:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IoTWirelessGatewayCertManager", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate", "iot:DescribeCertificate", "iot:ListCertificates" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T15:30:48.000Z", "lastUpdatedDate": "2020-12-15T15:30:48.000Z" }, "AWSIoTWirelessDataAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessDataAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:31:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotwireless:SendDataToWirelessDevice" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T15:31:39.000Z", "lastUpdatedDate": "2020-12-15T15:31:39.000Z" }, "AWSIoTWirelessLogging": { "arn": "arn:aws:iam::aws:policy/AWSIoTWirelessLogging", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T15:32:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/iotwireless*" } ] } } }, "createdDate": "2020-12-15T15:32:40.000Z", "lastUpdatedDate": "2020-12-15T15:32:40.000Z" }, "AWSCloudShellFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudShellFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-15T18:07:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudshell:*" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-12-15T18:07:44.000Z", "lastUpdatedDate": "2020-12-15T18:07:44.000Z" }, "AmazonPrometheusFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPrometheusFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2020-12-15T18:10:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aps:*" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2020-12-15T18:10:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllPrometheusActions", "Effect": "Allow", "Action": [ "aps:*" ], "Resource": "*" }, { "Sid": "DescribeCluster", "Effect": "Allow", "Action": [ "eks:DescribeCluster", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "aps.amazonaws.com" ] } }, "Resource": "*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/scraper.aps.amazonaws.com/AWSServiceRoleForAmazonPrometheusScraper*", "Condition": { "StringEquals": { "iam:AWSServiceName": "scraper.aps.amazonaws.com" } } } ] } } }, "createdDate": "2020-12-15T18:10:46.000Z", "lastUpdatedDate": "2023-11-26T20:16:13.000Z" }, "AmazonPrometheusConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPrometheusConsoleFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2020-12-15T18:11:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aps:CreateWorkspace", "aps:DescribeWorkspace", "aps:UpdateWorkspaceAlias", "aps:DeleteWorkspace", "aps:ListWorkspaces" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2021-09-29T15:29:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:GetTagValues", "tag:GetTagKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aps:CreateWorkspace", "aps:DescribeWorkspace", "aps:UpdateWorkspaceAlias", "aps:DeleteWorkspace", "aps:ListWorkspaces", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:CreateAlertManagerDefinition", "aps:CreateRuleGroupsNamespace", "aps:DeleteAlertManagerDefinition", "aps:DeleteRuleGroupsNamespace", "aps:ListRuleGroupsNamespaces", "aps:PutAlertManagerDefinition", "aps:PutRuleGroupsNamespace", "aps:TagResource", "aps:UntagResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-24T22:25:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:GetTagValues", "tag:GetTagKeys" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aps:CreateWorkspace", "aps:DescribeWorkspace", "aps:UpdateWorkspaceAlias", "aps:DeleteWorkspace", "aps:ListWorkspaces", "aps:DescribeAlertManagerDefinition", "aps:DescribeRuleGroupsNamespace", "aps:CreateAlertManagerDefinition", "aps:CreateRuleGroupsNamespace", "aps:DeleteAlertManagerDefinition", "aps:DeleteRuleGroupsNamespace", "aps:ListRuleGroupsNamespaces", "aps:PutAlertManagerDefinition", "aps:PutRuleGroupsNamespace", "aps:TagResource", "aps:UntagResource", "aps:CreateLoggingConfiguration", "aps:UpdateLoggingConfiguration", "aps:DeleteLoggingConfiguration", "aps:DescribeLoggingConfiguration" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-15T18:11:10.000Z", "lastUpdatedDate": "2022-10-24T22:25:39.000Z" }, "AmazonPrometheusQueryAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPrometheusQueryAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-19T01:02:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aps:GetLabels", "aps:GetMetricMetadata", "aps:GetSeries", "aps:QueryMetrics" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-12-19T01:02:58.000Z", "lastUpdatedDate": "2020-12-19T01:02:58.000Z" }, "AmazonPrometheusRemoteWriteAccess": { "arn": "arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-19T01:04:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "aps:RemoteWrite" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2020-12-19T01:04:32.000Z", "lastUpdatedDate": "2020-12-19T01:04:32.000Z" }, "AmazonFISServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonFISServiceRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2020-12-21T21:18:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-01-18T15:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "eks:DescribeNodegroup" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-06-30T13:50:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "eks:DescribeNodegroup" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-01-06T16:43:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "EventBridgeDescribe", "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*" }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "eks:DescribeNodegroup" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2022-07-06T11:03:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "EventBridgeDescribe", "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*" }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "ecs:DescribeTasks", "ecs:ListTasks", "eks:DescribeNodegroup", "eks:DescribeCluster" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-02-07T11:13:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "EventBridgeDescribe", "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*" }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "ecs:DescribeTasks", "ecs:ListTasks", "eks:DescribeNodegroup" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2022-10-25T09:05:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "fis.amazonaws.com" } } }, { "Sid": "EventBridgeDescribe", "Effect": "Allow", "Action": [ "events:DescribeRule" ], "Resource": "*" }, { "Sid": "Tagging", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmHistory" ], "Resource": "*" }, { "Sid": "DescribeUserResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSubnets", "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "ecs:DescribeClusters", "ecs:DescribeTasks", "ecs:ListTasks", "eks:DescribeNodegroup", "eks:DescribeCluster" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-21T21:18:19.000Z", "lastUpdatedDate": "2022-10-25T09:05:23.000Z" }, "AmazonSageMakerCoreServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonSageMakerCoreServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2020-12-21T21:40:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:AuthorizedService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" } ] } } }, "createdDate": "2020-12-21T21:40:47.000Z", "lastUpdatedDate": "2020-12-21T21:40:47.000Z" }, "AmazonLexV2BotPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexV2BotPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-13T20:10:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "polly:SynthesizeSpeech" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2021-01-13T20:10:29.000Z", "lastUpdatedDate": "2021-01-13T20:10:29.000Z" }, "AmazonLexChannelsAccess": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexChannelsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-13T20:12:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "lex:ListBots" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2021-01-13T20:12:46.000Z", "lastUpdatedDate": "2021-01-13T20:12:46.000Z" }, "AWSDirectConnectServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDirectConnectServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-14T18:35:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:*directconnect*" ] } ] } } }, "createdDate": "2021-01-14T18:35:27.000Z", "lastUpdatedDate": "2021-01-14T18:35:27.000Z" }, "AWSOpsWorks_FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSOpsWorks_FullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-22T16:29:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRoles", "iam:ListUsers", "opsworks:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "opsworks.amazonaws.com" } } } ] } } }, "createdDate": "2021-01-22T16:29:08.000Z", "lastUpdatedDate": "2021-01-22T16:29:08.000Z" }, "AWSElasticBeanstalkReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-22T19:02:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAPIs", "Effect": "Allow", "Action": [ "acm:ListCertificates", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribePolicies", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:ListStacks", "cloudformation:ValidateTemplate", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeDBSnapshots", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource": "*" }, { "Sid": "AllowS3", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" } ] } } }, "createdDate": "2021-01-22T19:02:37.000Z", "lastUpdatedDate": "2021-01-22T19:02:37.000Z" }, "AdministratorAccess-AWSElasticBeanstalk": { "arn": "arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2021-03-09T22:36:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Validate*", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codecommit:Get*", "codecommit:UploadArchive", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroup*", "ecs:CreateCluster", "ecs:DeRegisterTaskDefinition", "ecs:Describe*", "ecs:List*", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:Describe*", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "logs:Describe*", "rds:Describe*", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:*" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:SignalResource", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/Elastic-Beanstalk-*" }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:TagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/awseb-e-*", "arn:aws:dynamodb:*:*:table/eb-*" ] }, { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster" ], "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*Rule", "elasticloadbalancing:*Tags", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/eb-*", "arn:aws:elasticloadbalancing:*:*:listener/*/awseb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/*/eb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/eb-*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-elasticbeanstalk*", "arn:aws:iam::*:instance-profile/aws-elasticbeanstalk*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk*", "Condition": { "StringLike": { "iam:PolicyArn": [ "arn:aws:iam::aws:policy/AWSElasticBeanstalk*", "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalk*" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*", "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing*", "arn:aws:iam::*:role/aws-service-role/managedupdates.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/maintenance.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "elasticbeanstalk.amazonaws.com", "elasticloadbalancing.amazonaws.com", "managedupdates.elasticbeanstalk.amazonaws.com", "maintenance.elasticbeanstalk.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Effect": "Allow", "Action": [ "rds:*DBSubnetGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:CreateDBSecurityGroup", "rds:DeleteDBInstance", "rds:DeleteDBSecurityGroup", "rds:ModifyDBInstance", "rds:RestoreDBInstanceFromDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:secgrp:eb-*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:subgrp:awseb-e-*", "arn:aws:rds:*:*:subgrp:eb-*" ] }, { "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Effect": "Allow", "Action": [ "sqs:*QueueAttributes", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SendMessage", "sqs:TagQueue" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] } ] } }, "v1": { "createdDate": "2021-01-22T19:36:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Validate*", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codecommit:Get*", "codecommit:UploadArchive", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroup*", "ecs:CreateCluster", "ecs:DeRegisterTaskDefinition", "ecs:Describe*", "ecs:List*", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:Describe*", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "logs:Describe*", "rds:Describe*", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:*" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:SignalResource", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/Elastic-Beanstalk-*" }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:TagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/awseb-e-*", "arn:aws:dynamodb:*:*:table/eb-*" ] }, { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster" ], "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*Rule", "elasticloadbalancing:*Tags", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/eb-*", "arn:aws:elasticloadbalancing:*:*:listener/*/awseb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/*/eb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/eb-*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-elasticbeanstalk*", "arn:aws:iam::*:instance-profile/aws-elasticbeanstalk*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk*", "Condition": { "StringLike": { "iam:PolicyArn": [ "arn:aws:iam::aws:policy/AWSElasticBeanstalk*", "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalk*" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*", "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing*", "arn:aws:iam::*:role/aws-service-role/managedupdates.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/maintenance.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "elasticbeanstalk.amazonaws.com", "elasticloadbalancing.amazonaws.com", "managedupdates.elasticbeanstalk.amazonaws.com", "maintenance.elasticbeanstalk.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Effect": "Allow", "Action": [ "rds:*DBSubnetGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:CreateDBSecurityGroup", "rds:DeleteDBInstance", "rds:DeleteDBSecurityGroup", "rds:ModifyDBInstance", "rds:RestoreDBInstanceFromDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:secgrp:eb-*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:subgrp:awseb-e-*", "arn:aws:rds:*:*:subgrp:eb-*" ] }, { "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Effect": "Allow", "Action": [ "sqs:*QueueAttributes", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SendMessage", "sqs:TagQueue" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] } ] } }, "v3": { "createdDate": "2023-03-23T23:45:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Validate*", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codecommit:Get*", "codecommit:UploadArchive", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroup*", "ecs:CreateCluster", "ecs:DeRegisterTaskDefinition", "ecs:Describe*", "ecs:List*", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:Describe*", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "logs:Describe*", "rds:Describe*", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:*" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:SignalResource", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/Elastic-Beanstalk-*" }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:TagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/awseb-e-*", "arn:aws:dynamodb:*:*:table/eb-*" ] }, { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster" ], "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*Rule", "elasticloadbalancing:*Tags", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/eb-*", "arn:aws:elasticloadbalancing:*:*:listener/*/awseb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/*/eb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/eb-*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-elasticbeanstalk*", "arn:aws:iam::*:instance-profile/aws-elasticbeanstalk*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk*", "Condition": { "StringLike": { "iam:PolicyArn": [ "arn:aws:iam::aws:policy/AWSElasticBeanstalk*", "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalk*" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*", "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing*", "arn:aws:iam::*:role/aws-service-role/managedupdates.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/maintenance.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "elasticbeanstalk.amazonaws.com", "elasticloadbalancing.amazonaws.com", "managedupdates.elasticbeanstalk.amazonaws.com", "maintenance.elasticbeanstalk.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Effect": "Allow", "Action": [ "rds:*DBSubnetGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:CreateDBSecurityGroup", "rds:DeleteDBInstance", "rds:DeleteDBSecurityGroup", "rds:ModifyDBInstance", "rds:RestoreDBInstanceFromDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:secgrp:eb-*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:subgrp:awseb-e-*", "arn:aws:rds:*:*:subgrp:eb-*" ] }, { "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Effect": "Allow", "Action": [ "sqs:*QueueAttributes", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SendMessage", "sqs:TagQueue" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] } }, "v4": { "createdDate": "2021-01-22T19:36:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm:Describe*", "acm:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Validate*", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codecommit:Get*", "codecommit:UploadArchive", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroup*", "ecs:CreateCluster", "ecs:DeRegisterTaskDefinition", "ecs:Describe*", "ecs:List*", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:Describe*", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "logs:Describe*", "rds:Describe*", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:*" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:SignalResource", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/Elastic-Beanstalk-*" }, { "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:TagResource" ], "Resource": [ "arn:aws:dynamodb:*:*:table/awseb-e-*", "arn:aws:dynamodb:*:*:table/eb-*" ] }, { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster" ], "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*Rule", "elasticloadbalancing:*Tags", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:*" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/eb-*", "arn:aws:elasticloadbalancing:*:*:listener/*/awseb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/*/eb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/eb-*/*/*/*" ] }, { "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/aws-elasticbeanstalk*", "arn:aws:iam::*:instance-profile/aws-elasticbeanstalk*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-elasticbeanstalk*", "Condition": { "ArnLike": { "iam:PolicyArn": [ "arn:aws:iam::aws:policy/AWSElasticBeanstalk*", "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalk*" ] } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*", "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing*", "arn:aws:iam::*:role/aws-service-role/managedupdates.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/maintenance.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "elasticbeanstalk.amazonaws.com", "elasticloadbalancing.amazonaws.com", "managedupdates.elasticbeanstalk.amazonaws.com", "maintenance.elasticbeanstalk.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Effect": "Allow", "Action": [ "rds:*DBSubnetGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:CreateDBSecurityGroup", "rds:DeleteDBInstance", "rds:DeleteDBSecurityGroup", "rds:ModifyDBInstance", "rds:RestoreDBInstanceFromDBSnapshot" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:secgrp:eb-*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:subgrp:awseb-e-*", "arn:aws:rds:*:*:subgrp:eb-*" ] }, { "Effect": "Allow", "Action": [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Effect": "Allow", "Action": [ "sqs:*QueueAttributes", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SendMessage", "sqs:TagQueue" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] } } }, "createdDate": "2021-01-22T19:36:54.000Z", "lastUpdatedDate": "2024-12-11T14:36:06.000Z" }, "AmazonWorkMailMessageFlowReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkMailMessageFlowReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-01-28T12:40:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "workmailmessageflow:Get*" ], "Resource": "*", "Effect": "Allow" } ] } } }, "createdDate": "2021-01-28T12:40:08.000Z", "lastUpdatedDate": "2021-01-28T12:40:08.000Z" }, "AmazonCodeGuruProfilerAgentAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruProfilerAgentAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-02-05T22:11:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codeguru-profiler:ConfigureAgent", "codeguru-profiler:PostAgentProfile" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-04-02T23:21:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codeguru-profiler:ConfigureAgent", "codeguru-profiler:CreateProfilingGroup", "codeguru-profiler:PostAgentProfile" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-05-05T18:11:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codeguru-profiler:ConfigureAgent", "codeguru-profiler:CreateProfilingGroup", "codeguru-profiler:PostAgentProfile" ], "Resource": "arn:aws:codeguru-profiler:*:*:profilingGroup/*" } ] } } }, "createdDate": "2021-02-05T22:11:56.000Z", "lastUpdatedDate": "2022-05-05T18:11:03.000Z" }, "AmazonWorkMailMessageFlowFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkMailMessageFlowFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-02-11T11:08:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workmailmessageflow:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-02-11T11:08:35.000Z", "lastUpdatedDate": "2021-02-11T11:08:35.000Z" }, "AmazonEventBridgeApiDestinationsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-02-11T20:52:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!connection/*" } ] } }, "v2": { "createdDate": "2021-02-11T20:52:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!connection/*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com", "kms:EncryptionContext:SecretARN": [ "arn:aws:secretsmanager:*:*:secret:events!connection/*" ] }, "StringEquals": { "aws:ResourceTag/EventBridgeApiDestinations": "true" } } } ] } } }, "createdDate": "2021-02-11T20:52:05.000Z", "lastUpdatedDate": "2025-03-28T20:07:07.000Z" }, "AmazonHealthLakeFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHealthLakeFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-02-17T01:07:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "healthlake:*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation", "iam:ListRoles" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "healthlake.amazonaws.com" } } } ] } } }, "createdDate": "2021-02-17T01:07:05.000Z", "lastUpdatedDate": "2021-02-17T01:07:05.000Z" }, "AmazonHealthLakeReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonHealthLakeReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-02-17T02:43:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "healthlake:ListFHIRDatastores", "healthlake:DescribeFHIRDatastore", "healthlake:DescribeFHIRImportJob", "healthlake:DescribeFHIRExportJob", "healthlake:GetCapabilities", "healthlake:ReadResource", "healthlake:SearchWithGet", "healthlake:SearchWithPost" ], "Effect": "Allow", "Resource": "*" } ] } } }, "createdDate": "2021-02-17T02:43:31.000Z", "lastUpdatedDate": "2021-02-17T02:43:31.000Z" }, "AWSProtonDeveloperAccess": { "arn": "arn:aws:iam::aws:policy/AWSProtonDeveloperAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-02-17T19:02:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "proton:ListServiceTemplates", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServices", "proton:ListServiceInstances", "proton:ListEnvironments", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetService", "proton:GetServiceInstance", "proton:GetEnvironment", "proton:CreateService", "proton:UpdateService", "proton:UpdateServiceInstance", "proton:UpdateServicePipeline", "proton:DeleteService", "codestar-connections:ListConnections" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codestar-connections:PassConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2022-04-21T12:57:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:ListRepositories", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "codestar-connections:UseConnection", "proton:CancelServiceInstanceDeployment", "proton:CancelServicePipelineDeployment", "proton:CreateService", "proton:DeleteService", "proton:GetAccountRoles", "proton:GetAccountSettings", "proton:GetEnvironment", "proton:GetEnvironmentAccountConnection", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateMajorVersion", "proton:GetEnvironmentTemplateMinorVersion", "proton:GetEnvironmentTemplateVersion", "proton:GetRepository", "proton:GetRepositorySyncStatus", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetServiceTemplateVersion", "proton:GetTemplateSyncConfig", "proton:GetTemplateSyncStatus", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironmentOutputs", "proton:ListEnvironmentProvisionedResources", "proton:ListEnvironments", "proton:ListEnvironmentTemplateMajorVersions", "proton:ListEnvironmentTemplateMinorVersions", "proton:ListEnvironmentTemplates", "proton:ListEnvironmentTemplateVersions", "proton:ListRepositories", "proton:ListRepositorySyncDefinitions", "proton:ListServiceInstanceOutputs", "proton:ListServiceInstanceProvisionedResources", "proton:ListServiceInstances", "proton:ListServicePipelineOutputs", "proton:ListServicePipelineProvisionedResources", "proton:ListServices", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServiceTemplates", "proton:ListServiceTemplateVersions", "proton:ListTagsForResource", "proton:UpdateService", "proton:UpdateServiceInstance", "proton:UpdateServicePipeline", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-11-18T18:35:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:ListRepositories", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "codestar-connections:UseConnection", "proton:CancelServiceInstanceDeployment", "proton:CancelServicePipelineDeployment", "proton:CreateService", "proton:DeleteService", "proton:GetAccountRoles", "proton:GetAccountSettings", "proton:GetEnvironment", "proton:GetEnvironmentAccountConnection", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateMajorVersion", "proton:GetEnvironmentTemplateMinorVersion", "proton:GetEnvironmentTemplateVersion", "proton:GetRepository", "proton:GetRepositorySyncStatus", "proton:GetResourcesSummary", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetServiceTemplateVersion", "proton:GetTemplateSyncConfig", "proton:GetTemplateSyncStatus", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironmentOutputs", "proton:ListEnvironmentProvisionedResources", "proton:ListEnvironments", "proton:ListEnvironmentTemplateMajorVersions", "proton:ListEnvironmentTemplateMinorVersions", "proton:ListEnvironmentTemplates", "proton:ListEnvironmentTemplateVersions", "proton:ListRepositories", "proton:ListRepositorySyncDefinitions", "proton:ListServiceInstanceOutputs", "proton:ListServiceInstanceProvisionedResources", "proton:ListServiceInstances", "proton:ListServicePipelineOutputs", "proton:ListServicePipelineProvisionedResources", "proton:ListServices", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServiceTemplates", "proton:ListServiceTemplateVersions", "proton:ListTagsForResource", "proton:UpdateService", "proton:UpdateServiceInstance", "proton:UpdateServicePipeline", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2021-02-17T19:02:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProtonPermissions", "Effect": "Allow", "Action": [ "codecommit:ListRepositories", "codepipeline:GetPipeline", "codepipeline:GetPipelineExecution", "codepipeline:GetPipelineState", "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "codestar-connections:UseConnection", "proton:CancelServiceInstanceDeployment", "proton:CancelServicePipelineDeployment", "proton:CreateService", "proton:DeleteService", "proton:GetAccountRoles", "proton:GetAccountSettings", "proton:GetEnvironment", "proton:GetEnvironmentAccountConnection", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateMajorVersion", "proton:GetEnvironmentTemplateMinorVersion", "proton:GetEnvironmentTemplateVersion", "proton:GetRepository", "proton:GetRepositorySyncStatus", "proton:GetResourcesSummary", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetServiceTemplateVersion", "proton:GetTemplateSyncConfig", "proton:GetTemplateSyncStatus", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironmentOutputs", "proton:ListEnvironmentProvisionedResources", "proton:ListEnvironments", "proton:ListEnvironmentTemplateMajorVersions", "proton:ListEnvironmentTemplateMinorVersions", "proton:ListEnvironmentTemplates", "proton:ListEnvironmentTemplateVersions", "proton:ListRepositories", "proton:ListRepositorySyncDefinitions", "proton:ListServiceInstanceOutputs", "proton:ListServiceInstanceProvisionedResources", "proton:ListServiceInstances", "proton:ListServicePipelineOutputs", "proton:ListServicePipelineProvisionedResources", "proton:ListServices", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServiceTemplates", "proton:ListServiceTemplateVersions", "proton:ListTagsForResource", "proton:UpdateService", "proton:UpdateServiceInstance", "proton:UpdateServicePipeline", "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "*" }, { "Sid": "CodeStarConnectionsPermissions", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } }, { "Sid": "CodeConnectionsPermissions", "Effect": "Allow", "Action": "codeconnections:PassConnection", "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEquals": { "codeconnections:PassedToService": "proton.amazonaws.com" } } } ] } } }, "createdDate": "2021-02-17T19:02:08.000Z", "lastUpdatedDate": "2024-06-06T18:26:38.000Z" }, "AWSStorageGatewayServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSStorageGatewayServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-02-17T19:03:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" } ] } } }, "createdDate": "2021-02-17T19:03:19.000Z", "lastUpdatedDate": "2021-02-17T19:03:19.000Z" }, "AWSProtonFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSProtonFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-02-17T19:07:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "proton:*", "codestar-connections:ListConnections", "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "proton.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "proton.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "codestar-connections:PassConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2022-06-20T12:36:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "proton:*", "codestar-connections:ListConnections", "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "proton.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "proton.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sync.proton.amazonaws.com/AWSServiceRoleForProtonSync", "Condition": { "StringEquals": { "iam:AWSServiceName": "sync.proton.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "codestar-connections:PassConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2021-02-17T19:07:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProtonPermissions", "Effect": "Allow", "Action": [ "proton:*", "codestar-connections:ListConnections", "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "CreateGrantPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "proton.*.amazonaws.com" } } }, { "Sid": "PassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "proton.amazonaws.com" } } }, { "Sid": "CreateServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sync.proton.amazonaws.com/AWSServiceRoleForProtonSync", "Condition": { "StringEquals": { "iam:AWSServiceName": "sync.proton.amazonaws.com" } } }, { "Sid": "CodeStarConnectionsPermissions", "Effect": "Allow", "Action": [ "codestar-connections:PassConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEquals": { "codestar-connections:PassedToService": "proton.amazonaws.com" } } }, { "Sid": "CodeConnectionsPermissions", "Effect": "Allow", "Action": [ "codeconnections:PassConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEquals": { "codeconnections:PassedToService": "proton.amazonaws.com" } } } ] } } }, "createdDate": "2021-02-17T19:07:18.000Z", "lastUpdatedDate": "2024-06-06T18:29:00.000Z" }, "AWSProtonReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSProtonReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-02-17T19:09:12.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "proton:List*", "proton:Get*" ], "Resource": "*" } } }, "v2": { "createdDate": "2022-04-21T12:33:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:GetPipelineExecution", "proton:GetAccountRoles", "proton:GetAccountSettings", "proton:GetEnvironment", "proton:GetEnvironmentAccountConnection", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateMajorVersion", "proton:GetEnvironmentTemplateMinorVersion", "proton:GetEnvironmentTemplateVersion", "proton:GetRepository", "proton:GetRepositorySyncStatus", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetServiceTemplateVersion", "proton:GetTemplateSyncConfig", "proton:GetTemplateSyncStatus", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironmentOutputs", "proton:ListEnvironmentProvisionedResources", "proton:ListEnvironments", "proton:ListEnvironmentTemplateMajorVersions", "proton:ListEnvironmentTemplateMinorVersions", "proton:ListEnvironmentTemplates", "proton:ListEnvironmentTemplateVersions", "proton:ListRepositories", "proton:ListRepositorySyncDefinitions", "proton:ListServiceInstanceOutputs", "proton:ListServiceInstanceProvisionedResources", "proton:ListServiceInstances", "proton:ListServicePipelineOutputs", "proton:ListServicePipelineProvisionedResources", "proton:ListServices", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServiceTemplates", "proton:ListServiceTemplateVersions", "proton:ListTagsForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-18T18:28:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codepipeline:ListPipelineExecutions", "codepipeline:ListPipelines", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:GetPipelineExecution", "proton:GetAccountRoles", "proton:GetAccountSettings", "proton:GetEnvironment", "proton:GetEnvironmentAccountConnection", "proton:GetEnvironmentTemplate", "proton:GetEnvironmentTemplateMajorVersion", "proton:GetEnvironmentTemplateMinorVersion", "proton:GetEnvironmentTemplateVersion", "proton:GetRepository", "proton:GetRepositorySyncStatus", "proton:GetResourcesSummary", "proton:GetService", "proton:GetServiceInstance", "proton:GetServiceTemplate", "proton:GetServiceTemplateMajorVersion", "proton:GetServiceTemplateMinorVersion", "proton:GetServiceTemplateVersion", "proton:GetTemplateSyncConfig", "proton:GetTemplateSyncStatus", "proton:ListEnvironmentAccountConnections", "proton:ListEnvironmentOutputs", "proton:ListEnvironmentProvisionedResources", "proton:ListEnvironments", "proton:ListEnvironmentTemplateMajorVersions", "proton:ListEnvironmentTemplateMinorVersions", "proton:ListEnvironmentTemplates", "proton:ListEnvironmentTemplateVersions", "proton:ListRepositories", "proton:ListRepositorySyncDefinitions", "proton:ListServiceInstanceOutputs", "proton:ListServiceInstanceProvisionedResources", "proton:ListServiceInstances", "proton:ListServicePipelineOutputs", "proton:ListServicePipelineProvisionedResources", "proton:ListServices", "proton:ListServiceTemplateMajorVersions", "proton:ListServiceTemplateMinorVersions", "proton:ListServiceTemplates", "proton:ListServiceTemplateVersions", "proton:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2021-02-17T19:09:12.000Z", "lastUpdatedDate": "2022-11-18T18:28:24.000Z" }, "AWSGrafanaConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSGrafanaConsoleReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-02-23T00:10:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaConsoleReadOnlyAccess", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" } ] } }, "v2": { "createdDate": "2021-09-21T20:36:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaConsoleReadOnlyAccess", "Effect": "Allow", "Action": [ "grafana:Describe*", "grafana:List*" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" } ] } }, "v3": { "createdDate": "2022-02-15T22:30:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaConsoleReadOnlyAccess", "Effect": "Allow", "Action": [ "grafana:Describe*", "grafana:List*" ], "Resource": "*" } ] } } }, "createdDate": "2021-02-23T00:10:40.000Z", "lastUpdatedDate": "2022-02-15T22:30:54.000Z" }, "AWSGrafanaWorkspacePermissionManagement": { "arn": "arn:aws:iam::aws:policy/AWSGrafanaWorkspacePermissionManagement", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-02-23T00:15:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:UpdatePermissions", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" } ] } }, "v2": { "createdDate": "2021-09-21T20:30:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:UpdatePermissions", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" } ] } }, "v4": { "createdDate": "2023-03-15T22:17:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:UpdatePermissions", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" }, { "Sid": "IAMIdentityCenterPermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:GetSharedSsoConfiguration", "sso:ListDirectoryAssociations", "sso:GetManagedApplicationInstance", "sso:ListProfiles", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:GetProfile", "sso:ListProfileAssociations", "sso-directory:DescribeUser", "sso-directory:DescribeGroup" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-12-20T20:27:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:UpdatePermissions", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" }, { "Sid": "IAMIdentityCenterPermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:GetSharedSsoConfiguration", "sso:ListDirectoryAssociations", "sso:GetManagedApplicationInstance", "sso:ListProfiles", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:GetProfile", "sso:ListProfileAssociations" ], "Resource": "*" } ] } } }, "createdDate": "2021-02-23T00:15:54.000Z", "lastUpdatedDate": "2023-03-15T22:17:26.000Z" }, "AWSGrafanaAccountAdministrator": { "arn": "arn:aws:iam::aws:policy/AWSGrafanaAccountAdministrator", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-02-23T00:20:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaOrganizationAdmin", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GrafanaIAMGetRolePermission", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:*" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" }, { "Sid": "GrafanaIAMPassRolePermission", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "grafana.amazonaws.com" } } }, { "Sid": "SSOSLRPermission", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "sso.amazonaws.com" } }, "Resource": "arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO" } ] } }, "v2": { "createdDate": "2021-10-13T22:13:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaOrganizationAdmin", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GrafanaIAMGetRolePermission", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:*" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" }, { "Sid": "GrafanaIAMPassRolePermission", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "grafana.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-02-15T22:36:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaOrganizationAdmin", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GrafanaIAMGetRolePermission", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:*" ], "Resource": "*" }, { "Sid": "GrafanaIAMPassRolePermission", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "grafana.amazonaws.com" } } } ] } } }, "createdDate": "2021-02-23T00:20:38.000Z", "lastUpdatedDate": "2022-02-15T22:36:18.000Z" }, "AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2021-03-03T22:18:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] } ] } }, "v2": { "createdDate": "2021-03-09T22:36:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] } ] } }, "v3": { "createdDate": "2021-06-16T22:40:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] } ] } }, "v4": { "createdDate": "2022-12-22T01:07:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] } ] } }, "v5": { "createdDate": "2023-01-23T23:48:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] } ] } }, "v6": { "createdDate": "2023-03-23T23:15:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] } }, "v7": { "createdDate": "2021-03-03T22:18:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } }, { "Sid": "LaunchTemplateTagPropagationPermissions", "Effect": "Allow", "Action": "ec2:createTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "RunInstances" ] } } } ] } } }, "createdDate": "2021-03-03T22:18:00.000Z", "lastUpdatedDate": "2025-02-27T16:07:07.000Z" }, "BatchServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/BatchServiceRolePolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2021-03-10T06:55:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v2": { "createdDate": "2021-03-11T18:03:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v3": { "createdDate": "2021-03-25T22:50:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v4": { "createdDate": "2021-12-07T02:15:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v5": { "createdDate": "2022-05-18T20:05:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v6": { "createdDate": "2022-10-17T17:20:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "eks:DescribeCluster", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } }, "v7": { "createdDate": "2021-03-10T06:55:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSBatchPolicyStatement1", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "eks:DescribeCluster", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource": "*" }, { "Sid": "AWSBatchPolicyStatement2", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Sid": "AWSBatchPolicyStatement3", "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Sid": "AWSBatchPolicyStatement4", "Effect": "Allow", "Action": [ "autoscaling:CreateOrUpdateTags" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Sid": "AWSBatchPolicyStatement5", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Sid": "AWSBatchPolicyStatement6", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Sid": "AWSBatchPolicyStatement7", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Sid": "AWSBatchPolicyStatement8", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSBatchServiceTag": "false" } } }, { "Sid": "AWSBatchPolicyStatement9", "Effect": "Allow", "Action": [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Sid": "AWSBatchPolicyStatement10", "Effect": "Allow", "Action": [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Sid": "AWSBatchPolicyStatement11", "Effect": "Allow", "Action": [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Sid": "AWSBatchPolicyStatement12", "Effect": "Allow", "Action": [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task-definition/*" }, { "Sid": "AWSBatchPolicyStatement13", "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*/*" }, { "Sid": "AWSBatchPolicyStatement14", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Sid": "AWSBatchPolicyStatement15", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid": "AWSBatchPolicyStatement16", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSBatchServiceTag": "false" } } }, { "Sid": "AWSBatchPolicyStatement17", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } } }, "createdDate": "2021-03-10T06:55:36.000Z", "lastUpdatedDate": "2023-12-05T22:52:40.000Z" }, "AmazonEMRServicePolicy_v2": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-03-12T01:11:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateInTaggedNetwork", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateWithEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplateVersion" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": "ec2:CreateLaunchTemplate", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedInstancesAndVolumes", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ResourcesToLaunchEC2", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/ami-*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:placement-group/EMR_*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:dedicated-host/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid": "ManageEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ManageTagsOnEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateNetworkInterfaceNeededForPrivateSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateTaggedEMRResources", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", "CreateNetworkInterface" ] } } }, { "Sid": "TagPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:placement-group/EMR_*" ] }, { "Sid": "ListActionsForEC2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "CreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateDefaultSecurityGroupInVPCWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "ManageSecurityGroups", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreatePlacementGroup" ], "Resource": "arn:aws:ec2:*:*:placement-group/EMR_*" }, { "Sid": "DeletePlacementGroups", "Effect": "Allow", "Action": [ "ec2:DeletePlacementGroup" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "*" }, { "Sid": "ResourceGroupsForCapacityReservations", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "AutoScalingCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling" }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } } ] } }, "v2": { "createdDate": "2022-02-15T16:48:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateInTaggedNetwork", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateWithEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplateVersion" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": "ec2:CreateLaunchTemplate", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedInstancesAndVolumes", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ResourcesToLaunchEC2", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/ami-*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:placement-group/EMR_*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:dedicated-host/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid": "ManageEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ManageTagsOnEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateNetworkInterfaceNeededForPrivateSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateTaggedEMRResources", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", "CreateNetworkInterface" ] } } }, { "Sid": "TagPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:placement-group/EMR_*" ] }, { "Sid": "ListActionsForEC2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "CreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateDefaultSecurityGroupInVPCWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "ManageSecurityGroups", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreatePlacementGroup" ], "Resource": "arn:aws:ec2:*:*:placement-group/EMR_*" }, { "Sid": "DeletePlacementGroups", "Effect": "Allow", "Action": [ "ec2:DeletePlacementGroup" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "*" }, { "Sid": "ResourceGroupsForCapacityReservations", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "AutoScalingCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling" }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } } ] } }, "v3": { "createdDate": "2021-03-12T01:11:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateInTaggedNetwork", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateWithEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplateVersion" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": "ec2:CreateLaunchTemplate", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedInstancesAndVolumes", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ResourcesToLaunchEC2", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/ami-*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:placement-group/EMR_*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:dedicated-host/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid": "ManageEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ManageTagsOnEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateNetworkInterfaceNeededForPrivateSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateTaggedEMRResources", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", "CreateNetworkInterface" ] } } }, { "Sid": "TagPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:placement-group/EMR_*" ] }, { "Sid": "ListActionsForEC2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "CreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateDefaultSecurityGroupInVPCWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "ManageSecurityGroups", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreatePlacementGroup" ], "Resource": "arn:aws:ec2:*:*:placement-group/EMR_*" }, { "Sid": "DeletePlacementGroups", "Effect": "Allow", "Action": [ "ec2:DeletePlacementGroup" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "*" }, { "Sid": "ResourceGroupsForCapacityReservations", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "AutoScalingCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling" }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } } ] } }, "v4": { "createdDate": "2021-03-12T01:11:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateInTaggedNetwork", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateWithEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplateVersion" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedLaunchTemplate", "Effect": "Allow", "Action": "ec2:CreateLaunchTemplate", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRTaggedInstancesAndVolumes", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ResourcesToLaunchEC2", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/ami-*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:placement-group/EMR_*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:dedicated-host/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid": "ManageEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ManageTagsOnEMRTaggedResources", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateNetworkInterfaceNeededForPrivateSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateTaggedEMRResources", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", "CreateNetworkInterface" ] } } }, { "Sid": "TagPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:placement-group/EMR_*" ] }, { "Sid": "ListActionsForEC2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "CreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateDefaultSecurityGroupInVPCWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "TagOnCreateDefaultSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "ManageSecurityGroups", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEMRPlacementGroups", "Effect": "Allow", "Action": [ "ec2:CreatePlacementGroup" ], "Resource": "arn:aws:ec2:*:*:placement-group/EMR_*" }, { "Sid": "DeletePlacementGroups", "Effect": "Allow", "Action": [ "ec2:DeletePlacementGroup" ], "Resource": "*" }, { "Sid": "AutoScaling", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "*" }, { "Sid": "ResourceGroupsForCapacityReservations", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "AutoScalingCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling" }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "CreateAndModifyEmrServiceVPCEndpoint", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "CreateEmrServiceVPCEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "aws:RequestTag/Name": "emr-service-vpce" } } }, { "Sid": "TagEmrServiceVPCEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint", "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "aws:RequestTag/Name": "emr-service-vpce" } } } ] } } }, "createdDate": "2021-03-12T01:11:08.000Z", "lastUpdatedDate": "2025-03-03T20:37:06.000Z" }, "AmazonEMRReadOnlyAccessPolicy_v2": { "arn": "arn:aws:iam::aws:policy/AmazonEMRReadOnlyAccessPolicy_v2", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-03-12T01:39:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticMapReduceActions", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Action": [ "cloudwatch:GetMetricStatistics" ], "Effect": "Allow", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-04-21T22:31:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeReleaseLabel", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-08-02T19:15:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeReleaseLabel", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } } }, "createdDate": "2021-03-12T01:39:16.000Z", "lastUpdatedDate": "2023-08-02T19:15:33.000Z" }, "AmazonEMRFullAccessPolicy_v2": { "arn": "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-03-12T01:50:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunJobFlowExplicitlyWithEMRManagedTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:AddInstanceFleet", "elasticmapreduce:AddInstanceGroups", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:CancelSteps", "elasticmapreduce:CreateEditor", "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteEditor", "elasticmapreduce:DeleteSecurityConfiguration", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ModifyCluster", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:ModifyInstanceGroups", "elasticmapreduce:OpenEditorInConsole", "elasticmapreduce:PutAutoScalingPolicy", "elasticmapreduce:PutBlockPublicAccessConfiguration", "elasticmapreduce:PutManagedScalingPolicy", "elasticmapreduce:RemoveAutoScalingPolicy", "elasticmapreduce:RemoveManagedScalingPolicy", "elasticmapreduce:RemoveTags", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "PassRoleForElasticMapReduce", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "ElasticMapReduceServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringLike": { "iam:AWSServiceName": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "ConsoleUIActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "s3:ListBuckets", "iam:ListRoles" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-03-23T16:57:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunJobFlowExplicitlyWithEMRManagedTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:AddInstanceFleet", "elasticmapreduce:AddInstanceGroups", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:CancelSteps", "elasticmapreduce:CreateEditor", "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteEditor", "elasticmapreduce:DeleteSecurityConfiguration", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ModifyCluster", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:ModifyInstanceGroups", "elasticmapreduce:OpenEditorInConsole", "elasticmapreduce:PutAutoScalingPolicy", "elasticmapreduce:PutBlockPublicAccessConfiguration", "elasticmapreduce:PutManagedScalingPolicy", "elasticmapreduce:RemoveAutoScalingPolicy", "elasticmapreduce:RemoveManagedScalingPolicy", "elasticmapreduce:RemoveTags", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "PassRoleForElasticMapReduce", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "ElasticMapReduceServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } }, { "Sid": "ConsoleUIActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets", "iam:ListRoles" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-04-21T22:31:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunJobFlowExplicitlyWithEMRManagedTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:AddInstanceFleet", "elasticmapreduce:AddInstanceGroups", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:CancelSteps", "elasticmapreduce:CreateEditor", "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteEditor", "elasticmapreduce:DeleteSecurityConfiguration", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeReleaseLabel", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ModifyCluster", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:ModifyInstanceGroups", "elasticmapreduce:OpenEditorInConsole", "elasticmapreduce:PutAutoScalingPolicy", "elasticmapreduce:PutBlockPublicAccessConfiguration", "elasticmapreduce:PutManagedScalingPolicy", "elasticmapreduce:RemoveAutoScalingPolicy", "elasticmapreduce:RemoveManagedScalingPolicy", "elasticmapreduce:RemoveTags", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "PassRoleForElasticMapReduce", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_DefaultRole_V2", "Condition": { "StringLike": { "iam:PassedToService": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "ElasticMapReduceServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } }, { "Sid": "ConsoleUIActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets", "iam:ListRoles" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-07-28T14:04:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunJobFlowExplicitlyWithEMRManagedTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:AddInstanceFleet", "elasticmapreduce:AddInstanceGroups", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:CancelSteps", "elasticmapreduce:CreateEditor", "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteEditor", "elasticmapreduce:DeleteSecurityConfiguration", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeReleaseLabel", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ModifyCluster", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:ModifyInstanceGroups", "elasticmapreduce:OpenEditorInConsole", "elasticmapreduce:PutAutoScalingPolicy", "elasticmapreduce:PutBlockPublicAccessConfiguration", "elasticmapreduce:PutManagedScalingPolicy", "elasticmapreduce:RemoveAutoScalingPolicy", "elasticmapreduce:RemoveManagedScalingPolicy", "elasticmapreduce:RemoveTags", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "PassRoleForElasticMapReduce", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_DefaultRole_V2", "Condition": { "StringLike": { "iam:PassedToService": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "ElasticMapReduceServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } }, { "Sid": "ConsoleUIActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets", "iam:ListRoles" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-03-12T01:50:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunJobFlowExplicitlyWithEMRManagedTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "ElasticMapReduceActions", "Effect": "Allow", "Action": [ "elasticmapreduce:AddInstanceFleet", "elasticmapreduce:AddInstanceGroups", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:CancelSteps", "elasticmapreduce:CreateEditor", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteEditor", "elasticmapreduce:DeleteSecurityConfiguration", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribeEditor", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeStep", "elasticmapreduce:DescribeReleaseLabel", "elasticmapreduce:GetBlockPublicAccessConfiguration", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetAutoTerminationPolicy", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListEditors", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:ListSteps", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ModifyCluster", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:ModifyInstanceGroups", "elasticmapreduce:OpenEditorInConsole", "elasticmapreduce:PutAutoScalingPolicy", "elasticmapreduce:PutBlockPublicAccessConfiguration", "elasticmapreduce:PutManagedScalingPolicy", "elasticmapreduce:RemoveAutoScalingPolicy", "elasticmapreduce:RemoveManagedScalingPolicy", "elasticmapreduce:RemoveTags", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ViewEventsFromAllClustersInConsole" ], "Resource": "*" }, { "Sid": "ViewMetricsInEMRConsole", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "PassRoleForElasticMapReduce", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_DefaultRole_V2", "Condition": { "StringLike": { "iam:PassedToService": "elasticmapreduce.amazonaws.com*" } } }, { "Sid": "PassRoleForEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com*" } } }, { "Sid": "PassRoleForAutoScaling", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole", "Condition": { "StringLike": { "iam:PassedToService": "application-autoscaling.amazonaws.com*" } } }, { "Sid": "ElasticMapReduceServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "elasticmapreduce.amazonaws.com", "elasticmapreduce.amazonaws.com.cn" ] } } }, { "Sid": "ConsoleUIActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeKeyPairs", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "s3:ListAllMyBuckets", "iam:ListRoles" ], "Resource": "*" } ] } } }, "createdDate": "2021-03-12T01:50:29.000Z", "lastUpdatedDate": "2025-03-27T22:07:07.000Z" }, "AWSSecurityHubOrganizationsAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityHubOrganizationsAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-03-15T20:53:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securityhub.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "arn:aws:organizations::*:account/o-*/*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securityhub.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-03-15T20:53:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:ListRoots", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" }, { "Sid": "OrganizationPermissionsEnable", "Effect": "Allow", "Action": "organizations:EnableAWSServiceAccess", "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securityhub.amazonaws.com" } } }, { "Sid": "OrganizationPermissionsDelegatedAdmin", "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "arn:aws:organizations::*:account/o-*/*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securityhub.amazonaws.com" } } } ] } } }, "createdDate": "2021-03-15T20:53:03.000Z", "lastUpdatedDate": "2023-11-16T21:13:44.000Z" }, "AWSApplicationMigrationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationMigrationServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-04-07T06:43:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgn:ListTagsForResource", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:AssociateCreatedArtifact", "mgh:CreateProgressUpdateStream", "mgh:DisassociateCreatedArtifact", "mgh:GetHomeRegion", "mgh:ImportMigrationTask", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } } ] } }, "v2": { "createdDate": "2023-06-20T09:12:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgn:ListTagsForResource", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:AssociateCreatedArtifact", "mgh:CreateProgressUpdateStream", "mgh:DisassociateCreatedArtifact", "mgh:GetHomeRegion", "mgh:ImportMigrationTask", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": "arn:aws:organizations::*:account/*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } } ] } }, "v3": { "createdDate": "2021-04-07T06:43:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgn:ListTagsForResource", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:AssociateCreatedArtifact", "mgh:CreateProgressUpdateStream", "mgh:DisassociateCreatedArtifact", "mgh:GetHomeRegion", "mgh:ImportMigrationTask", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": "arn:aws:organizations::*:account/*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } } ] } }, "v4": { "createdDate": "2021-04-07T06:43:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "mgn:ListTagsForResource", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:AssociateCreatedArtifact", "mgh:CreateProgressUpdateStream", "mgh:DisassociateCreatedArtifact", "mgh:GetHomeRegion", "mgh:ImportMigrationTask", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": "arn:aws:organizations::*:account/*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage", "ec2:DeregisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } } ] } } }, "createdDate": "2021-04-07T06:43:20.000Z", "lastUpdatedDate": "2025-03-16T10:37:07.000Z" }, "AWSApplicationMigrationConversionServerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationConversionServerPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-04-07T06:48:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendClientMetricsForMgn", "mgn:SendClientLogsForMgn", "mgn:GetChannelCommandsForMgn", "mgn:SendChannelCommandResultForMgn" ], "Resource": "*" } ] } } }, "createdDate": "2021-04-07T06:48:58.000Z", "lastUpdatedDate": "2021-04-07T06:48:58.000Z" }, "AWSApplicationMigrationFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationFullAccess", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2021-04-07T06:56:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-02-22T11:16:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" } ] } }, "v3": { "createdDate": "2022-05-01T08:31:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-05-31T21:14:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-ConvertCentOsToRockyLinuxDistribution", "arn:aws:ssm:*:*:document/AWSMigration-ReplaceSuseSubscriptionWithAwsSubscription" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": "*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-ConvertCentOsToRockyLinuxDistribution", "arn:aws:ssm:*:*:document/AWSMigration-ReplaceSuseSubscriptionWithAwsSubscription" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-08-11T16:08:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-ConvertCentOsToRockyLinuxDistribution", "arn:aws:ssm:*:*:document/AWSMigration-ReplaceSuseSubscriptionWithAwsSubscription" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": "*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-ConvertCentOsToRockyLinuxDistribution", "arn:aws:ssm:*:*:document/AWSMigration-ReplaceSuseSubscriptionWithAwsSubscription" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DisconnectSourceServer" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceConfiguredDR": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2023-04-20T17:28:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": "*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DisconnectSourceServer" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceConfiguredDR": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*" }, { "Effect": "Allow", "Action": [ "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/AWSMigration-*:$DEFAULT", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "mgn.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ssm:ListCommands", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2023-03-20T10:43:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": "*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "drs:DisconnectSourceServer" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceConfiguredDR": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*" }, { "Effect": "Allow", "Action": [ "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/AWSMigration-*:$DEFAULT", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "mgn.amazonaws.com" } } } ] } }, "v8": { "createdDate": "2021-04-07T06:56:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "mgn:*" ], "Resource": "*" }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "ec2:DescribeKeyPairs", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "VisualEditor5", "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Sid": "VisualEditor6", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole", "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "VisualEditor7", "Effect": "Allow", "Action": [ "drs:DescribeSourceServers" ], "Resource": "*" }, { "Sid": "VisualEditor8", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Sid": "VisualEditor9", "Effect": "Allow", "Action": [ "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "VisualEditor10", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": "*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "VisualEditor11", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "VisualEditor12", "Effect": "Allow", "Action": [ "drs:DisconnectSourceServer" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceConfiguredDR": "false" } } }, { "Sid": "VisualEditor13", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" }, { "Sid": "VisualEditor14", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "VisualEditor15", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*" }, { "Sid": "VisualEditor16", "Effect": "Allow", "Action": [ "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance", "arn:aws:ssm:*:*:document/AWSMigration-*" ] }, { "Sid": "VisualEditor17", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "VisualEditor18", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/AWSMigration-*:$DEFAULT", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "mgn.amazonaws.com" } } }, { "Sid": "VisualEditor19", "Effect": "Allow", "Action": "ssm:ListCommands", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "VisualEditor20", "Effect": "Allow", "Action": [ "ssm:DescribeParameters" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } } ] } } }, "createdDate": "2021-04-07T06:56:05.000Z", "lastUpdatedDate": "2024-05-19T08:30:02.000Z" }, "AWSApplicationMigrationAgentPolicy": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationAgentPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-04-07T07:00:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:SendClientLogsForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:RegisterAgentForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentInstallationAssetsForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*" } ] } }, "v2": { "createdDate": "2022-09-20T11:13:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:SendClientMetricsForMgn", "mgn:SendClientLogsForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:RegisterAgentForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentInstallationAssetsForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*" } ] } } }, "createdDate": "2021-04-07T07:00:21.000Z", "lastUpdatedDate": "2022-09-20T11:13:40.000Z" }, "AWSApplicationMigrationEC2Access": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationEC2Access", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v2": { "createdDate": "2022-03-02T08:49:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v1": { "createdDate": "2021-04-07T07:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } } ] } }, "v3": { "createdDate": "2022-11-27T09:36:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateLaunchTemplate" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v4": { "createdDate": "2023-02-06T16:07:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "ec2:DescribeVolumes" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateLaunchTemplate" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v5": { "createdDate": "2021-04-07T07:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "ec2:DescribeVolumes" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateLaunchTemplate" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v6": { "createdDate": "2021-04-07T07:05:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots", "ec2:DescribeImages", "ec2:DescribeVolumes" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateLaunchTemplate" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "Null": { "ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } } }, "createdDate": "2021-04-07T07:05:22.000Z", "lastUpdatedDate": "2025-02-11T13:07:07.000Z" }, "AWSApplicationMigrationMGHAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationMGHAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-04-07T07:10:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgh:AssociateCreatedArtifact", "mgh:CreateProgressUpdateStream", "mgh:DisassociateCreatedArtifact", "mgh:GetHomeRegion", "mgh:ImportMigrationTask", "mgh:NotifyMigrationTaskState", "mgh:PutResourceAttributes" ], "Resource": "*" } ] } } }, "createdDate": "2021-04-07T07:10:01.000Z", "lastUpdatedDate": "2021-04-07T07:10:01.000Z" }, "AWSApplicationMigrationReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-04-07T07:15:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeSourceServers", "mgn:DescribeReplicationConfigurationTemplates", "mgn:GetLaunchConfiguration", "mgn:GetReplicationConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-05-01T08:32:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeSourceServers", "mgn:DescribeReplicationConfigurationTemplates", "mgn:GetLaunchConfiguration", "mgn:DescribeVcenterClients", "mgn:GetReplicationConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-08T12:54:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeSourceServers", "mgn:DescribeReplicationConfigurationTemplates", "mgn:GetLaunchConfiguration", "mgn:DescribeVcenterClients", "mgn:GetReplicationConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-11-27T09:08:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeSourceServers", "mgn:DescribeReplicationConfigurationTemplates", "mgn:GetLaunchConfiguration", "mgn:DescribeVcenterClients", "mgn:GetReplicationConfiguration", "mgn:DescribeLaunchConfigurationTemplates", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListApplications", "mgn:ListWaves" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-03-20T08:58:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:DescribeJobLogItems", "mgn:DescribeJobs", "mgn:DescribeSourceServers", "mgn:DescribeReplicationConfigurationTemplates", "mgn:GetLaunchConfiguration", "mgn:DescribeVcenterClients", "mgn:GetReplicationConfiguration", "mgn:DescribeLaunchConfigurationTemplates", "mgn:ListSourceServerActions", "mgn:ListTemplateActions", "mgn:ListApplications", "mgn:ListWaves", "mgn:ListExports", "mgn:ListImports", "mgn:ListImportErrors", "mgn:ListExportErrors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } } }, "createdDate": "2021-04-07T07:15:26.000Z", "lastUpdatedDate": "2023-03-20T08:58:08.000Z" }, "AWSApplicationMigrationReplicationServerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationReplicationServerPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-04-07T07:21:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendClientMetricsForMgn", "mgn:SendClientLogsForMgn", "mgn:GetChannelCommandsForMgn", "mgn:SendChannelCommandResultForMgn", "mgn:GetAgentSnapshotCreditsForMgn", "mgn:DescribeReplicationServerAssociationsForMgn", "mgn:DescribeSnapshotRequestsForMgn", "mgn:BatchDeleteSnapshotRequestForMgn", "mgn:NotifyAgentAuthenticationForMgn", "mgn:BatchCreateVolumeSnapshotGroupForMgn", "mgn:UpdateAgentReplicationProcessStateForMgn", "mgn:NotifyAgentReplicationProgressForMgn", "mgn:NotifyAgentConnectedForMgn", "mgn:NotifyAgentDisconnectedForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } } ] } } }, "createdDate": "2021-04-07T07:21:57.000Z", "lastUpdatedDate": "2021-04-07T07:21:57.000Z" }, "AmazonLookoutEquipmentFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutEquipmentFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-04-08T15:52:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lookoutequipment.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:RetireGrant", "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "lookoutequipment.*.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-05-05T16:46:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lookoutequipment.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:RetireGrant", "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "lookoutequipment.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-24T21:00:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lookoutequipment.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "lookoutequipment.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" } ] } } }, "createdDate": "2021-04-08T15:52:08.000Z", "lastUpdatedDate": "2021-11-24T21:00:13.000Z" }, "AWSCompromisedKeyQuarantineV2": { "arn": "arn:aws:iam::aws:policy/AWSCompromisedKeyQuarantineV2", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-04-21T22:30:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:DeleteBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2021-11-11T21:32:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2022-08-10T21:15:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "cloudtrail:LookupEvents", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2023-03-16T00:20:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "cloudtrail:LookupEvents", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets", "ec2:PurchaseReservedInstancesOffering", "ec2:AcceptReservedInstancesExchangeQuote", "ec2:CreateReservedInstancesListing", "savingsplans:CreateSavingsPlan" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2021-04-21T22:30:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "cloudtrail:LookupEvents", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets", "ec2:PurchaseReservedInstancesOffering", "ec2:AcceptReservedInstancesExchangeQuote", "ec2:CreateReservedInstancesListing", "savingsplans:CreateSavingsPlan", "ecs:CreateService", "ecs:CreateCluster", "ecs:RegisterTaskDefinition", "ecr:GetAuthorizationToken", "bedrock:CreateModelInvocationJob", "bedrock:InvokeModelWithResponseStream", "bedrock:CreateFoundationModelAgreement", "bedrock:PutFoundationModelEntitlement", "bedrock:InvokeModel", "s3:CreateBucket", "s3:PutBucketCors", "s3:GetObject", "s3:ListBucket", "sagemaker:CreateEndpointConfig", "sagemaker:CreateProcessingJob", "ses:GetSendQuota", "ses:ListIdentities", "sts:GetSessionToken", "sts:GetFederationToken", "amplify:CreateDeployment", "amplify:CreateBackendEnvironment", "codebuild:CreateProject", "glue:CreateJob", "iam:DeleteRole", "iam:DeleteAccessKey", "iam:ListUsers", "lambda:GetEventSourceMapping", "sns:GetSMSAttributes", "mediapackagev2:CreateChannel" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2021-04-21T22:30:59.000Z", "lastUpdatedDate": "2024-10-02T16:41:39.000Z" }, "AWSSystemsManagerOpsDataSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSystemsManagerOpsDataSyncServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-04-26T20:42:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/ExplorerSecurityHubOpsItem": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "securityhub:GetFindings", "securityhub:BatchUpdateFindings" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "StringEquals": { "securityhub:ASFFSyntaxPath/Workflow.Status": "SUPPRESSED" }, "Null": { "securityhub:ASFFSyntaxPath/Confidence": false, "securityhub:ASFFSyntaxPath/Criticality": false, "securityhub:ASFFSyntaxPath/Note": false, "securityhub:ASFFSyntaxPath/RelatedFindings": false, "securityhub:ASFFSyntaxPath/Types": false, "securityhub:ASFFSyntaxPath/UserDefinedFields": false, "securityhub:ASFFSyntaxPath/VerificationState": false } } } ] } }, "v2": { "createdDate": "2023-06-28T22:53:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/ExplorerSecurityHubOpsItem": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:CreateOpsItem" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*" ] }, { "Effect": "Allow", "Action": [ "securityhub:GetFindings", "securityhub:BatchUpdateFindings" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "StringEquals": { "securityhub:ASFFSyntaxPath/Workflow.Status": "SUPPRESSED" } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/Confidence": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/Criticality": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/Note.Text": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/Note.UpdatedBy": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/RelatedFindings": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/Types": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/UserDefinedFields.key": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/UserDefinedFields.value": false } } }, { "Effect": "Deny", "Action": "securityhub:BatchUpdateFindings", "Resource": "*", "Condition": { "Null": { "securityhub:ASFFSyntaxPath/VerificationState": false } } } ] } } }, "createdDate": "2021-04-26T20:42:39.000Z", "lastUpdatedDate": "2023-06-28T22:53:43.000Z" }, "AWSCloudWatchAlarms_ActionSSMIncidentsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSCloudWatchAlarms_ActionSSMIncidentsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-04-27T13:30:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "StartIncidentPermissions", "Effect": "Allow", "Action": "ssm-incidents:StartIncident", "Resource": "*" } ] } } }, "createdDate": "2021-04-27T13:30:52.000Z", "lastUpdatedDate": "2021-04-27T13:30:52.000Z" }, "AmazonNimbleStudio-LaunchProfileWorker": { "arn": "arn:aws:iam::aws:policy/AmazonNimbleStudio-LaunchProfileWorker", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-04-28T04:47:02.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } }, "Sid": "GetLaunchProfileInitializationDependencies" } ], "Version": "2012-10-17" } } }, "createdDate": "2021-04-28T04:47:02.000Z", "lastUpdatedDate": "2021-04-28T04:47:02.000Z" }, "AmazonNimbleStudio-StudioAdmin": { "arn": "arn:aws:iam::aws:policy/AmazonNimbleStudio-StudioAdmin", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-04-28T04:47:36.000Z", "document": { "Statement": [ { "Sid": "StudioAdminFullAccess", "Effect": "Allow", "Action": [ "nimble:CreateStreamingSession", "nimble:GetStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:DeleteStreamingSession", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetEula", "nimble:AcceptEulas", "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListStreamingSessions", "nimble:GetStreamingImage", "nimble:ListStreamingImages", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileDetails", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents", "nimble:ListLaunchProfiles", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileMember", "nimble:ListLaunchProfileMembers", "nimble:PutLaunchProfileMembers", "nimble:UpdateLaunchProfileMember", "nimble:DeleteLaunchProfileMember" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2021-11-01T20:02:36.000Z", "document": { "Statement": [ { "Sid": "StudioAdminFullAccess", "Effect": "Allow", "Action": [ "nimble:CreateStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:DeleteStreamingSession", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetEula", "nimble:AcceptEulas", "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListStreamingSessions", "nimble:GetStreamingImage", "nimble:ListStreamingImages", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileDetails", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents", "nimble:ListLaunchProfiles", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileMember", "nimble:ListLaunchProfileMembers", "nimble:PutLaunchProfileMembers", "nimble:UpdateLaunchProfileMember", "nimble:DeleteLaunchProfileMember" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2022-12-20T19:25:22.000Z", "document": { "Statement": [ { "Sid": "StudioAdminFullAccess", "Effect": "Allow", "Action": [ "nimble:CreateStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:DeleteStreamingSession", "nimble:ListStreamingSessionBackups", "nimble:GetStreamingSessionBackup", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetEula", "nimble:AcceptEulas", "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListStreamingSessions", "nimble:GetStreamingImage", "nimble:ListStreamingImages", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileDetails", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents", "nimble:ListLaunchProfiles", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileMember", "nimble:ListLaunchProfileMembers", "nimble:PutLaunchProfileMembers", "nimble:UpdateLaunchProfileMember", "nimble:DeleteLaunchProfileMember" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2021-04-28T04:47:36.000Z", "document": { "Statement": [ { "Sid": "StudioAdminFullAccess", "Effect": "Allow", "Action": [ "nimble:CreateStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:DeleteStreamingSession", "nimble:ListStreamingSessionBackups", "nimble:GetStreamingSessionBackup", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetEula", "nimble:AcceptEulas", "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListStreamingSessions", "nimble:GetStreamingImage", "nimble:ListStreamingImages", "nimble:GetLaunchProfileInitialization", "nimble:GetLaunchProfileDetails", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents", "nimble:ListLaunchProfiles", "nimble:GetLaunchProfile", "nimble:GetLaunchProfileMember", "nimble:ListLaunchProfileMembers", "nimble:PutLaunchProfileMembers", "nimble:UpdateLaunchProfileMember", "nimble:DeleteLaunchProfileMember" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers", "identitystore:DescribeUser", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ds:DescribeDirectories", "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } } ], "Version": "2012-10-17" } } }, "createdDate": "2021-04-28T04:47:36.000Z", "lastUpdatedDate": "2023-09-22T17:40:41.000Z" }, "AmazonNimbleStudio-StudioUser": { "arn": "arn:aws:iam::aws:policy/AmazonNimbleStudio-StudioUser", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-04-28T04:48:11.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ec2:DescribeSubnets", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "nimble:ListLaunchProfiles" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:requesterPrincipalId": "${nimble:principalId}" } } }, { "Effect": "Allow", "Action": [ "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "nimble:DeleteStreamingSession", "nimble:GetStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:ListStreamingSessions" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:createdBy": "${nimble:requesterPrincipalId}" } } } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2021-08-16T18:26:50.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ec2:DescribeSubnets", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "nimble:ListLaunchProfiles" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:requesterPrincipalId": "${nimble:principalId}" } } }, { "Effect": "Allow", "Action": [ "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "nimble:DeleteStreamingSession", "nimble:GetStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:ListStreamingSessions" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:ownedBy": "${nimble:requesterPrincipalId}" } } } ], "Version": "2012-10-17" } }, "v3": { "createdDate": "2021-11-01T20:01:52.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ec2:DescribeSubnets", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "nimble:ListLaunchProfiles" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:requesterPrincipalId": "${nimble:principalId}" } } }, { "Effect": "Allow", "Action": [ "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "nimble:DeleteStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:ListStreamingSessions" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:ownedBy": "${nimble:requesterPrincipalId}" } } } ], "Version": "2012-10-17" } }, "v4": { "createdDate": "2022-12-20T19:31:23.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ec2:DescribeSubnets", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "nimble:ListLaunchProfiles" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:requesterPrincipalId": "${nimble:principalId}" } } }, { "Effect": "Allow", "Action": [ "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "nimble:DeleteStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:ListStreamingSessions", "nimble:ListStreamingSessionBackups", "nimble:GetStreamingSessionBackup" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:ownedBy": "${nimble:requesterPrincipalId}" } } } ], "Version": "2012-10-17" } }, "v5": { "createdDate": "2021-04-28T04:48:11.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ds:CreateComputer", "ec2:DescribeSubnets", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "fsx:DescribeFileSystems", "ds:DescribeDirectories" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "nimble.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:SearchUsers", "identitystore:DescribeUser", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "nimble:ListLaunchProfiles" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:requesterPrincipalId": "${nimble:principalId}" } } }, { "Effect": "Allow", "Action": [ "nimble:ListStudioMembers", "nimble:GetStudioMember", "nimble:ListEulas", "nimble:ListEulaAcceptances", "nimble:GetFeatureMap", "nimble:PutStudioLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "nimble:DeleteStreamingSession", "nimble:GetStreamingSession", "nimble:StartStreamingSession", "nimble:StopStreamingSession", "nimble:CreateStreamingSessionStream", "nimble:GetStreamingSessionStream", "nimble:ListStreamingSessions", "nimble:ListStreamingSessionBackups", "nimble:GetStreamingSessionBackup" ], "Resource": "*", "Condition": { "StringEquals": { "nimble:ownedBy": "${nimble:requesterPrincipalId}" } } } ], "Version": "2012-10-17" } } }, "createdDate": "2021-04-28T04:48:11.000Z", "lastUpdatedDate": "2023-09-22T17:45:14.000Z" }, "AmazonLookoutEquipmentReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutEquipmentReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-05-05T16:47:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListDatasets", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListModels", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-06-30T18:33:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:DescribeDataset", "lookoutequipment:DescribeDataIngestionJob", "lookoutequipment:DescribeModel", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListDatasets", "lookoutequipment:ListDataIngestionJobs", "lookoutequipment:ListModels", "lookoutequipment:ListInferenceSchedulers", "lookoutequipment:ListInferenceExecutions", "lookoutequipment:ListTagsForResource", "lookoutequipment:ListSensorStatistics" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-10T22:04:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutequipment:Describe*", "lookoutequipment:List*" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-05T16:47:55.000Z", "lastUpdatedDate": "2022-11-10T22:04:33.000Z" }, "AmazonLookoutMetricsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutMetricsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-05-07T00:43:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutmetrics:DescribeMetricSet", "lookoutmetrics:ListMetricSets", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:DescribeAnomalyDetectionExecutions", "lookoutmetrics:DescribeAlert", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListTagsForResource", "lookoutmetrics:ListAnomalyGroupSummaries", "lookoutmetrics:ListAnomalyGroupTimeSeries", "lookoutmetrics:GetAnomalyGroup", "lookoutmetrics:GetDataQualityMetrics", "lookoutmetrics:GetSampleData", "lookoutmetrics:GetFeedback" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-01-04T18:19:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutmetrics:DescribeMetricSet", "lookoutmetrics:ListMetricSets", "lookoutmetrics:DescribeAnomalyDetector", "lookoutmetrics:ListAnomalyDetectors", "lookoutmetrics:DescribeAnomalyDetectionExecutions", "lookoutmetrics:DescribeAlert", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListTagsForResource", "lookoutmetrics:ListAnomalyGroupSummaries", "lookoutmetrics:ListAnomalyGroupTimeSeries", "lookoutmetrics:ListAnomalyGroupRelatedMetrics", "lookoutmetrics:GetAnomalyGroup", "lookoutmetrics:GetDataQualityMetrics", "lookoutmetrics:GetSampleData", "lookoutmetrics:GetFeedback" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-07T00:43:34.000Z", "lastUpdatedDate": "2022-01-04T18:19:27.000Z" }, "AmazonLookoutMetricsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutMetricsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-07T00:43:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lookoutmetrics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*LookoutMetrics*", "Condition": { "StringEquals": { "iam:PassedToService": "lookoutmetrics.amazonaws.com" } } } ] } } }, "createdDate": "2021-05-07T00:43:38.000Z", "lastUpdatedDate": "2021-05-07T00:43:38.000Z" }, "AWSIncidentManagerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIncidentManagerServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-05-10T03:34:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "UpdateIncidentRecordPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:ListIncidentRecords", "ssm-incidents:CreateTimelineEvent" ], "Resource": "*" }, { "Sid": "RelatedOpsItemPermissions", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:AssociateOpsItemRelatedItem" ], "Resource": "*" }, { "Sid": "IncidentEngagementPermissions", "Effect": "Allow", "Action": "ssm-contacts:StartEngagement", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-12-05T02:11:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "UpdateIncidentRecordPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:ListIncidentRecords", "ssm-incidents:CreateTimelineEvent" ], "Resource": "*" }, { "Sid": "RelatedOpsItemPermissions", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:AssociateOpsItemRelatedItem" ], "Resource": "*" }, { "Sid": "IncidentEngagementPermissions", "Effect": "Allow", "Action": "ssm-contacts:StartEngagement", "Resource": "*" }, { "Sid": "PutMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IncidentManager" } } } ] } }, "v3": { "createdDate": "2021-05-10T03:34:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "UpdateIncidentRecordPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:ListIncidentRecords", "ssm-incidents:CreateTimelineEvent" ], "Resource": "*" }, { "Sid": "RelatedOpsItemPermissions", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:AssociateOpsItemRelatedItem" ], "Resource": "*" }, { "Sid": "IncidentEngagementPermissions", "Effect": "Allow", "Action": "ssm-contacts:StartEngagement", "Resource": "*" }, { "Sid": "PutMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/IncidentManager", "AWS/Usage" ] } } } ] } } }, "createdDate": "2021-05-10T03:34:45.000Z", "lastUpdatedDate": "2025-01-28T02:52:06.000Z" }, "AWSIncidentManagerResolverAccess": { "arn": "arn:aws:iam::aws:policy/AWSIncidentManagerResolverAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-10T06:12:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "StartIncidentPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:StartIncident" ], "Resource": "*" }, { "Sid": "ResponsePlanReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:ListResponsePlans", "ssm-incidents:GetResponsePlan" ], "Resource": "*" }, { "Sid": "IncidentRecordResolverPermissions", "Effect": "Allow", "Action": [ "ssm-incidents:ListIncidentRecords", "ssm-incidents:GetIncidentRecord", "ssm-incidents:UpdateIncidentRecord", "ssm-incidents:ListTimelineEvents", "ssm-incidents:CreateTimelineEvent", "ssm-incidents:GetTimelineEvent", "ssm-incidents:UpdateTimelineEvent", "ssm-incidents:DeleteTimelineEvent", "ssm-incidents:ListRelatedItems", "ssm-incidents:UpdateRelatedItems" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-10T06:12:34.000Z", "lastUpdatedDate": "2021-05-10T06:12:34.000Z" }, "AmazonLookoutVisionReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutVisionReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-05-11T19:11:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionReadOnlyAccess", "Effect": "Allow", "Action": [ "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-12-09T03:01:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionReadOnlyAccess", "Effect": "Allow", "Action": [ "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "lookoutvision:ListModelPackagingJobs" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-11T19:11:07.000Z", "lastUpdatedDate": "2021-12-09T03:01:51.000Z" }, "AmazonLookoutVisionFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutVisionFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-11T19:24:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionFullAccess", "Effect": "Allow", "Action": [ "lookoutvision:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-11T19:24:54.000Z", "lastUpdatedDate": "2021-05-11T19:24:54.000Z" }, "AmazonLookoutVisionConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutVisionConsoleReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-05-11T19:32:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionReadOnlyAccess", "Effect": "Allow", "Action": [ "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:DescribeTrialDetection", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "lookoutvision:ListTrialDetections" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3BucketSearchAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3ObjectReadAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::lookoutvision-*/*" }, { "Sid": "LookoutVisionConsoleDashboardAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-12-09T02:46:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionReadOnlyAccess", "Effect": "Allow", "Action": [ "lookoutvision:DescribeDataset", "lookoutvision:DescribeModel", "lookoutvision:DescribeProject", "lookoutvision:DescribeTrialDetection", "lookoutvision:DescribeModelPackagingJob", "lookoutvision:ListDatasetEntries", "lookoutvision:ListModels", "lookoutvision:ListProjects", "lookoutvision:ListTagsForResource", "lookoutvision:ListTrialDetections", "lookoutvision:ListModelPackagingJobs" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3BucketSearchAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3ObjectReadAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::lookoutvision-*/*" }, { "Sid": "LookoutVisionConsoleDashboardAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-11T19:32:02.000Z", "lastUpdatedDate": "2021-12-09T02:46:29.000Z" }, "AmazonLookoutVisionConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonLookoutVisionConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-11T19:37:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LookoutVisionFullAccess", "Effect": "Allow", "Action": [ "lookoutvision:*" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3BucketSearchAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleS3BucketFirstUseSetupAccess", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock" ], "Resource": "arn:aws:s3:::lookoutvision-*" }, { "Sid": "LookoutVisionConsoleS3BucketAccess", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketVersioning" ], "Resource": "arn:aws:s3:::lookoutvision-*" }, { "Sid": "LookoutVisionConsoleS3ObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": "arn:aws:s3:::lookoutvision-*/*" }, { "Sid": "LookoutVisionConsoleDatasetLabelingToolsAccess", "Effect": "Allow", "Action": [ "groundtruthlabeling:RunGenerateManifestByCrawlingJob", "groundtruthlabeling:AssociatePatchToManifestJob", "groundtruthlabeling:DescribeConsoleJob" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleDashboardAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleTagSelectorAccess", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Sid": "LookoutVisionConsoleKmsKeySelectorAccess", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-11T19:37:17.000Z", "lastUpdatedDate": "2021-05-11T19:37:17.000Z" }, "AppRunnerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AppRunnerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-14T19:15:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:log-group:/aws/apprunner/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apprunner/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets", "events:DescribeRule", "events:EnableRule", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/AWSAppRunnerManagedRule*" } ] } } }, "createdDate": "2021-05-14T19:15:04.000Z", "lastUpdatedDate": "2021-05-14T19:15:04.000Z" }, "AWSAppRunnerServicePolicyForECRAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-14T19:17:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability" ], "Resource": "*" } ] } } }, "createdDate": "2021-05-14T19:17:21.000Z", "lastUpdatedDate": "2021-05-14T19:17:21.000Z" }, "AWSServiceCatalogAppRegistryServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceCatalogAppRegistryServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-05-18T22:18:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudformation:DescribeStacks", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:CreateGroup", "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup", "resource-groups:UpdateGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } } ] } }, "v2": { "createdDate": "2021-08-11T19:49:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudformation:DescribeStacks", "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup", "resource-groups:UpdateGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } } ] } }, "v4": { "createdDate": "2022-10-26T16:05:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudformation:DescribeStacks", "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup", "resource-groups:UpdateGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Effect": "Allow", "Action": [ "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry*", "arn:*:resource-groups:*:*:group/AWS_CloudFormation_Stack*" ] } ] } }, "v3": { "createdDate": "2022-03-04T21:06:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudformation:DescribeStacks", "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup", "resource-groups:UpdateGroup", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:Tag", "resource-groups:Untag", "resource-groups:GetGroupConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } } ] } } }, "createdDate": "2021-05-18T22:18:55.000Z", "lastUpdatedDate": "2022-10-26T16:05:52.000Z" }, "AWSDeviceFarmTestGridServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDeviceFarmTestGridServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-05-26T22:01:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AWSDeviceFarmManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSDeviceFarmManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSDeviceFarmManaged": "true" } } } ] } } }, "createdDate": "2021-05-26T22:01:35.000Z", "lastUpdatedDate": "2021-05-26T22:01:35.000Z" }, "AWSKeyManagementServiceMultiRegionKeysServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSKeyManagementServiceMultiRegionKeysServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-06-16T15:37:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:SynchronizeMultiRegionKey" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-06-16T15:37:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "KMSSynchronizeMultiRegionKey", "Effect": "Allow", "Action": [ "kms:SynchronizeMultiRegionKey" ], "Resource": "*" } ] } } }, "createdDate": "2021-06-16T15:37:37.000Z", "lastUpdatedDate": "2024-11-13T22:53:54.000Z" }, "AWSSSMOpsInsightsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSSMOpsInsightsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-06-16T20:12:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCreateOpsItem", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:AddTagsToResource" ], "Resource": "*" }, { "Sid": "AllowAccessOpsItem", "Effect": "Allow", "Action": [ "ssm:UpdateOpsItem", "ssm:GetOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/SsmOperationalInsight": "true" } } } ] } } }, "createdDate": "2021-06-16T20:12:52.000Z", "lastUpdatedDate": "2021-06-16T20:12:52.000Z" }, "AWSBugBustServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSBugBustServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-06-24T06:59:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codeguru-reviewer:ListRecommendations", "codeguru-reviewer:UntagResource", "codeguru-reviewer:DescribeCodeReview" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/bugbust": "enabled" } } } ] } } }, "createdDate": "2021-06-24T06:59:05.000Z", "lastUpdatedDate": "2021-06-24T06:59:05.000Z" }, "AWSBugBustFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSBugBustFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-06-24T07:03:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeGuruReviewerPermission", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListRecommendations", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "CodeGuruProfilerPermission", "Effect": "Allow", "Action": [ "codeguru-profiler:ListProfilingGroups", "codeguru-profiler:DescribeProfilingGroup" ], "Resource": "*" }, { "Sid": "AWSBugBustFullAccess", "Effect": "Allow", "Action": [ "bugbust:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-07-22T20:04:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeGuruReviewerPermission", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListRecommendations", "codeguru-reviewer:ListCodeReviews" ], "Resource": "*" }, { "Sid": "CodeGuruProfilerPermission", "Effect": "Allow", "Action": [ "codeguru-profiler:ListProfilingGroups", "codeguru-profiler:DescribeProfilingGroup" ], "Resource": "*" }, { "Sid": "AWSBugBustFullAccess", "Effect": "Allow", "Action": [ "bugbust:*" ], "Resource": "*" }, { "Sid": "AWSBugBustSLRCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/bugbust.amazonaws.com/AWSServiceRoleForBugBust", "Condition": { "StringLike": { "iam:AWSServiceName": "bugbust.amazonaws.com" } } } ] } } }, "createdDate": "2021-06-24T07:03:26.000Z", "lastUpdatedDate": "2021-07-22T20:04:29.000Z" }, "AWSBugBustPlayerAccess": { "arn": "arn:aws:iam::aws:policy/AWSBugBustPlayerAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-06-24T07:15:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeGuruReviewerPermission", "Effect": "Allow", "Action": [ "codeguru-reviewer:DescribeCodeReview", "codeguru-reviewer:ListRecommendations" ], "Resource": "*" }, { "Sid": "CodeGuruProfilerPermission", "Effect": "Allow", "Action": [ "codeguru-profiler:DescribeProfilingGroup" ], "Resource": "*" }, { "Sid": "AWSBugBustPlayerAccess", "Effect": "Allow", "Action": [ "bugbust:ListBugs", "bugbust:ListProfilingGroups", "bugbust:JoinEvent", "bugbust:GetEvent", "bugbust:ListEvents", "bugbust:GetJoinEventStatus", "bugbust:ListEventScores", "bugbust:ListEventParticipants", "bugbust:UpdateWorkItem", "bugbust:ListPullRequests" ], "Resource": "*" } ] } } }, "createdDate": "2021-06-24T07:15:00.000Z", "lastUpdatedDate": "2021-06-24T07:15:00.000Z" }, "Route53RecoveryReadinessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/Route53RecoveryReadinessServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-07-15T16:06:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings" ], "Resource": "arn:aws:dynamodb:*:*:*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas", "Condition": { "StringLike": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "rds:DescribeDBClusters" ], "Resource": "arn:aws:rds:*:*:cluster:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": [ "route53:GetHealthCheck", "route53:GetHealthCheckStatus" ], "Resource": "arn:aws:route53:::healthcheck/*" }, { "Effect": "Allow", "Action": [ "servicequotas:RequestServiceQuotaIncrease" ], "Resource": "arn:aws:servicequotas:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": "arn:aws:sqs:*:*:*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "kafka:DescribeCluster", "kafka:DescribeConfigurationRevision", "lambda:ListFunctions", "rds:DescribeAccountAttributes", "route53:GetHostedZone", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "sns:GetEndpointAttributes", "sns:GetSubscriptionAttributes" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-10-06T18:52:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings" ], "Resource": "arn:aws:dynamodb:*:*:*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas", "Condition": { "StringLike": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:GetProvisionedConcurrencyConfig", "lambda:ListAliases", "lambda:ListVersionsByFunction" ], "Resource": "arn:aws:lambda:*:*:function:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBClusters" ], "Resource": "arn:aws:rds:*:*:cluster:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": [ "route53:GetHealthCheck", "route53:GetHealthCheckStatus" ], "Resource": "arn:aws:route53:::healthcheck/*" }, { "Effect": "Allow", "Action": [ "servicequotas:RequestServiceQuotaIncrease" ], "Resource": "arn:aws:servicequotas:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": "arn:aws:sqs:*:*:*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "kafka:DescribeCluster", "kafka:DescribeConfigurationRevision", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "rds:DescribeAccountAttributes", "route53:GetHostedZone", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "sns:GetEndpointAttributes", "sns:GetSubscriptionAttributes" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-10-29T07:09:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings" ], "Resource": "arn:aws:dynamodb:*:*:*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas", "Condition": { "StringLike": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:GetProvisionedConcurrencyConfig", "lambda:ListAliases", "lambda:ListVersionsByFunction" ], "Resource": "arn:aws:lambda:*:*:function:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBClusters" ], "Resource": "arn:aws:rds:*:*:cluster:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": [ "route53:GetHealthCheck", "route53:GetHealthCheckStatus" ], "Resource": "arn:aws:route53:::healthcheck/*" }, { "Effect": "Allow", "Action": [ "servicequotas:RequestServiceQuotaIncrease" ], "Resource": "arn:aws:servicequotas:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": "arn:aws:sqs:*:*:*" }, { "Effect": "Allow", "Action": [ "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "kafka:DescribeCluster", "kafka:DescribeConfigurationRevision", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "rds:DescribeAccountAttributes", "route53:GetHostedZone", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "sns:GetEndpointAttributes", "sns:GetSubscriptionAttributes" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-08-31T17:16:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings" ], "Resource": "arn:aws:dynamodb:*:*:*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas", "Condition": { "StringLike": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:GetProvisionedConcurrencyConfig", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListVersionsByFunction" ], "Resource": "arn:aws:lambda:*:*:function:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBClusters" ], "Resource": "arn:aws:rds:*:*:cluster:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": [ "route53:GetHealthCheck", "route53:GetHealthCheckStatus" ], "Resource": "arn:aws:route53:::healthcheck/*" }, { "Effect": "Allow", "Action": [ "servicequotas:RequestServiceQuotaIncrease" ], "Resource": "arn:aws:servicequotas:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": "arn:aws:sqs:*:*:*" }, { "Effect": "Allow", "Action": [ "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "kafka:DescribeCluster", "kafka:DescribeConfigurationRevision", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "rds:DescribeAccountAttributes", "route53:GetHostedZone", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "sns:GetEndpointAttributes", "sns:GetSubscriptionAttributes" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-02-14T18:08:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings" ], "Resource": "arn:aws:dynamodb:*:*:*" }, { "Effect": "Allow", "Action": [ "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive" ], "Resource": "arn:aws:dynamodb:*:*:table/*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas", "Condition": { "StringLike": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:GetProvisionedConcurrencyConfig", "lambda:ListProvisionedConcurrencyConfigs", "lambda:ListAliases", "lambda:ListVersionsByFunction" ], "Resource": "arn:aws:lambda:*:*:function:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBClusters" ], "Resource": "arn:aws:rds:*:*:cluster:*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": [ "route53:GetHealthCheck", "route53:GetHealthCheckStatus" ], "Resource": "arn:aws:route53:::healthcheck/*" }, { "Effect": "Allow", "Action": [ "servicequotas:RequestServiceQuotaIncrease" ], "Resource": "arn:aws:servicequotas:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": "arn:aws:sqs:*:*:*" }, { "Effect": "Allow", "Action": [ "apigateway:GET", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms", "dynamodb:DescribeLimits", "dynamodb:ListGlobalTables", "dynamodb:ListTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "kafka:DescribeCluster", "kafka:DescribeConfigurationRevision", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "rds:DescribeAccountAttributes", "route53:GetHostedZone", "servicequotas:ListAWSDefaultServiceQuotas", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListServiceQuotas", "servicequotas:ListServices", "sns:GetEndpointAttributes", "sns:GetSubscriptionAttributes" ], "Resource": "*" } ] } } }, "createdDate": "2021-07-15T16:06:21.000Z", "lastUpdatedDate": "2023-02-14T18:08:46.000Z" }, "AmazonSageMakerPipelinesIntegrations": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerPipelinesIntegrations", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-07-30T16:35:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*sageMaker*", "arn:aws:lambda:*:*:function:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:*sagemaker*", "arn:aws:sqs:*:*:*sageMaker*", "arn:aws:sqs:*:*:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2022-04-20T18:39:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*sageMaker*", "arn:aws:lambda:*:*:function:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:*sagemaker*", "arn:aws:sqs:*:*:*sageMaker*", "arn:aws:sqs:*:*:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:PutTargets" ], "Resource": [ "arn:aws:events:*:*:rule/SageMakerPipelineExecutionEMRStepStatusUpdateRule" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ] } ] } }, "v3": { "createdDate": "2023-02-17T21:28:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*sageMaker*", "arn:aws:lambda:*:*:function:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:*sagemaker*", "arn:aws:sqs:*:*:*sageMaker*", "arn:aws:sqs:*:*:*SageMaker*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com", "elasticmapreduce.amazonaws.com", "ec2.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:PutTargets" ], "Resource": [ "arn:aws:events:*:*:rule/SageMakerPipelineExecutionEMRStepStatusUpdateRule", "arn:aws:events:*:*:rule/SageMakerPipelineExecutionEMRClusterStatusUpdateRule" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:RunJobFlow", "elasticmapreduce:DescribeCluster", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:ListSteps" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ] } ] } } }, "createdDate": "2021-07-30T16:35:10.000Z", "lastUpdatedDate": "2023-02-17T21:28:19.000Z" }, "AmazonChimeTranscriptionServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonChimeTranscriptionServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-04T21:47:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "transcribe:StartStreamTranscription", "transcribe:StartMedicalStreamTranscription" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-04T21:47:41.000Z", "lastUpdatedDate": "2021-08-04T21:47:41.000Z" }, "AWSLicenseManagerConsumptionPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSLicenseManagerConsumptionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-11T23:18:08.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "license-manager:CheckoutLicense", "license-manager:CheckInLicense", "license-manager:ExtendLicenseConsumption", "license-manager:GetLicense" ], "Resource": "*" } } } }, "createdDate": "2021-08-11T23:18:08.000Z", "lastUpdatedDate": "2021-08-11T23:18:08.000Z" }, "MemoryDBServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MemoryDBServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-08-17T22:34:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonMemoryDBManaged" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AmazonMemoryDBManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/MemoryDB" } } } ] } }, "v2": { "createdDate": "2021-08-18T23:48:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonMemoryDBManaged" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AmazonMemoryDBManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/MemoryDB" } } } ] } }, "v3": { "createdDate": "2021-08-17T22:34:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateMemoryDBTagsOnNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonMemoryDBManaged" ] } } }, { "Sid": "CreateNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "DeleteMemoryDBTaggedNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AmazonMemoryDBManaged": "true" } } }, { "Sid": "DeleteNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Sid": "DescribeEC2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "PutCloudWatchMetricData", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/MemoryDB" } } }, { "Sid": "ReplicateMemoryDBMultiRegionClusterData", "Effect": "Allow", "Action": [ "memorydb:ReplicateMultiRegionClusterData" ], "Resource": "arn:aws:memorydb:*:*:cluster/*" } ] } } }, "createdDate": "2021-08-17T22:34:59.000Z", "lastUpdatedDate": "2024-12-01T16:21:07.000Z" }, "AWSApplicationAutoscalingElastiCacheRGPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingElastiCacheRGPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-08-17T23:41:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticache:DescribeReplicationGroups", "elasticache:ModifyReplicationGroupShardConfiguration", "elasticache:IncreaseReplicaCount", "elasticache:DecreaseReplicaCount", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameters", "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ] } ] } }, "v2": { "createdDate": "2021-08-17T23:41:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ElastiCacheActionsOnAllClusters", "Effect": "Allow", "Action": [ "elasticache:DescribeReplicationGroups", "elasticache:ModifyCacheCluster", "elasticache:ModifyReplicationGroupShardConfiguration", "elasticache:IncreaseReplicaCount", "elasticache:DecreaseReplicaCount", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameters" ], "Resource": [ "*" ] }, { "Sid": "CloudWatchActionsOnAllAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Sid": "CloudWatchActionsOnTargetTrackingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ] } ] } } }, "createdDate": "2021-08-17T23:41:42.000Z", "lastUpdatedDate": "2025-03-26T17:37:06.000Z" }, "AmazonS3ObjectLambdaExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonS3ObjectLambdaExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-18T10:07:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "s3-object-lambda:WriteGetObjectResponse" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T10:07:41.000Z", "lastUpdatedDate": "2021-08-18T10:07:41.000Z" }, "AmazonRoute53RecoveryReadinessFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryReadinessFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-18T16:45:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-readiness:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T16:45:07.000Z", "lastUpdatedDate": "2021-08-18T16:45:07.000Z" }, "AmazonRoute53RecoveryClusterReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryClusterReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-08-18T17:36:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-cluster:GetRoutingControlState" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-04-01T17:37:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-cluster:GetRoutingControlState", "route53-recovery-cluster:ListRoutingControls" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T17:36:01.000Z", "lastUpdatedDate": "2022-04-01T17:37:55.000Z" }, "AmazonRoute53RecoveryControlConfigFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryControlConfigFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-18T17:48:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-control-config:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T17:48:35.000Z", "lastUpdatedDate": "2021-08-18T17:48:35.000Z" }, "AmazonRoute53RecoveryControlConfigReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryControlConfigReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-08-18T18:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeRoutingControlByName", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListAssociatedRoute53HealthChecks", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-12-09T23:38:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeRoutingControlByName", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:ListAssociatedRoute53HealthChecks", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-08-18T18:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-control-config:DescribeCluster", "route53-recovery-control-config:DescribeControlPanel", "route53-recovery-control-config:DescribeRoutingControl", "route53-recovery-control-config:DescribeRoutingControlByName", "route53-recovery-control-config:DescribeSafetyRule", "route53-recovery-control-config:GetResourcePolicy", "route53-recovery-control-config:ListAssociatedRoute53HealthChecks", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-control-config:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T18:01:12.000Z", "lastUpdatedDate": "2023-10-18T17:15:33.000Z" }, "AmazonRoute53RecoveryReadinessReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryReadinessReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-11-09T20:14:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetReadinessCheckResourceStatus", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetRecoveryGroupReadinessSummary", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListCrossAccountAuthorizations", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53-recovery-readiness:ListRules", "route53-recovery-readiness:ListTagsForResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53-recovery-readiness:GetArchitectureRecommendations", "route53-recovery-readiness:GetCellReadinessSummary" ], "Resource": "arn:aws:route53-recovery-readiness::*:*" } ] } }, "v1": { "createdDate": "2021-08-18T18:11:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-readiness:ListCells", "route53-recovery-readiness:ListCrossAccountAuthorizations", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53-recovery-readiness:ListRules", "route53-recovery-readiness:ListTagsForResources", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetRecoveryGroupReadinessSummary", "route53-recovery-readiness:GetReadinessCheckResourceStatus", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T18:11:33.000Z", "lastUpdatedDate": "2021-11-09T20:14:51.000Z" }, "AmazonRoute53RecoveryClusterFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53RecoveryClusterFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-08-18T18:37:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53-recovery-cluster:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-08-18T18:37:00.000Z", "lastUpdatedDate": "2021-08-18T18:37:00.000Z" }, "AWSServiceRolePolicyForBackupReports": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRolePolicyForBackupReports", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-08-19T21:16:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:DescribeFramework", "backup:ListBackupJobs", "backup:ListRestoreJobs", "backup:ListCopyJobs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "config:DescribeConfigurationAggregators", "config:SelectAggregateResourceConfig", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:GetComplianceDetailsByConfigRule", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/backup.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator" ], "Resource": "arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/backup.amazonaws.com*" } ] } }, "v2": { "createdDate": "2023-03-10T00:51:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:DescribeFramework", "backup:ListBackupJobs", "backup:ListRestoreJobs", "backup:ListCopyJobs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:BatchGetResourceConfig", "config:SelectResourceConfig", "config:DescribeConfigurationAggregators", "config:SelectAggregateResourceConfig", "config:DescribeConfigRuleEvaluationStatus", "config:DescribeConfigRules", "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:GetComplianceDetailsByConfigRule", "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/backup.amazonaws.com*" }, { "Effect": "Allow", "Action": [ "config:DeleteConfigurationAggregator", "config:PutConfigurationAggregator" ], "Resource": "arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/backup.amazonaws.com*" } ] } } }, "createdDate": "2021-08-19T21:16:45.000Z", "lastUpdatedDate": "2023-03-10T00:51:25.000Z" }, "AWSBackupAuditAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupAuditAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-08-24T01:02:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:CreateFramework", "backup:UpdateFramework", "backup:ListFrameworks", "backup:DescribeFramework", "backup:DeleteFramework", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:CreateReportPlan", "backup:UpdateReportPlan", "backup:ListReportPlans", "backup:DescribeReportPlan", "backup:DeleteReportPlan", "backup:StartReportJob", "backup:ListReportJobs", "backup:DescribeReportJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeComplianceByConfigRule", "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" } ] } }, "v2": { "createdDate": "2023-04-10T21:23:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:CreateFramework", "backup:UpdateFramework", "backup:ListFrameworks", "backup:DescribeFramework", "backup:DeleteFramework", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:CreateReportPlan", "backup:UpdateReportPlan", "backup:ListReportPlans", "backup:DescribeReportPlan", "backup:DeleteReportPlan", "backup:StartReportJob", "backup:ListReportJobs", "backup:DescribeReportJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", "config:DescribeComplianceByConfigRule" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:GetComplianceDetailsByConfigRule" ], "Resource": "arn:aws:config:*:*:config-rule/*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" } ] } } }, "createdDate": "2021-08-24T01:02:23.000Z", "lastUpdatedDate": "2023-04-10T21:23:31.000Z" }, "AmazonOpenSearchServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchServiceRolePolicy", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2021-08-26T09:27:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-09-01T05:43:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-09-09T10:43:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-07-28T13:10:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-09-12T15:03:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973197", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } } ] } }, "v6": { "createdDate": "2022-10-13T14:05:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973197", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } } ] } }, "v7": { "createdDate": "2021-08-26T09:27:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973149", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973150", "Effect": "Allow", "Action": [ "ec2:UnAssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973197", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ES" } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } } ] } }, "v8": { "createdDate": "2021-08-26T09:27:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973149", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973150", "Effect": "Allow", "Action": [ "ec2:UnAssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973197", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/ES", "AWS/OpenSearch" ] } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } } ] } }, "v9": { "createdDate": "2021-08-26T09:27:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1480452973134", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973145", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "Stmt1480452973144", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973165", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "Stmt1480452973149", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973150", "Effect": "Allow", "Action": [ "ec2:UnAssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "Stmt1480452973154", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "Stmt1480452973164", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "Stmt1480452973174", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "Stmt1480452973184", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:listener/*" ] }, { "Sid": "Stmt1480452973194", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "Stmt1480452973195", "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "Stmt1480452973196", "Effect": "Allow", "Action": [ "acm:DescribeCertificate" ], "Resource": "*" }, { "Sid": "Stmt1480452973197", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/ES", "AWS/OpenSearch" ] } } }, { "Sid": "Stmt1480452973198", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "Stmt1480452973199", "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973200", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchManaged": "true" } } }, { "Sid": "Stmt1480452973201", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "Stmt1480452973202", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": "sso:PutApplicationAccessScope", "Resource": "arn:aws:sso::*:application/*/*", "Condition": { "StringEquals": { "aws:ResourceOrgID": "${aws:PrincipalOrgID}" } } } ] } } }, "createdDate": "2021-08-26T09:27:09.000Z", "lastUpdatedDate": "2025-03-27T22:52:06.000Z" }, "AmazonOpenSearchServiceCognitoAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchServiceCognitoAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-12-20T14:04:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPoolClient", "cognito-idp:UpdateUserPoolClient", "cognito-idp:DescribeUserPoolClient", "cognito-idp:AdminInitiateAuth", "cognito-idp:AdminUserGlobalSignOut", "cognito-idp:ListUserPoolClients", "cognito-identity:DescribeIdentityPool", "cognito-identity:UpdateIdentityPool", "cognito-identity:GetIdentityPoolRoles" ], "Resource": [ "arn:aws:cognito-identity:*:*:identitypool/*", "arn:aws:cognito-idp:*:*:userpool/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": [ "cognito-identity.amazonaws.com", "cognito-identity-us-gov.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "cognito-identity:SetIdentityPoolRoles", "Resource": "*" } ] } }, "v1": { "createdDate": "2021-09-02T06:31:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPool", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DescribeUserPoolClient", "cognito-idp:AdminInitiateAuth", "cognito-idp:AdminUserGlobalSignOut", "cognito-idp:ListUserPoolClients", "cognito-identity:DescribeIdentityPool", "cognito-identity:UpdateIdentityPool", "cognito-identity:SetIdentityPoolRoles", "cognito-identity:GetIdentityPoolRoles" ], "Resource": [ "arn:aws:cognito-identity:*:*:identitypool/*", "arn:aws:cognito-idp:*:*:userpool/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "cognito-identity.amazonaws.com" } } } ] } } }, "createdDate": "2021-09-02T06:31:49.000Z", "lastUpdatedDate": "2021-12-20T14:04:18.000Z" }, "AWSApplicationAutoscalingNeptuneClusterPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingNeptuneClusterPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-02T21:14:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:ListTagsForResource", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBClusterParameters", "cloudwatch:DescribeAlarms" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "rds:AddTagsToResource", "Resource": [ "arn:aws:rds:*:*:db:autoscaled-reader*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "neptune" } } }, { "Effect": "Allow", "Action": "rds:CreateDBInstance", "Resource": [ "arn:aws:rds:*:*:db:autoscaled-reader*", "arn:aws:rds:*:*:cluster:*" ], "Condition": { "StringEquals": { "rds:DatabaseEngine": "neptune" } } }, { "Effect": "Allow", "Action": [ "rds:DeleteDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:autoscaled-reader*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ] } ] } } }, "createdDate": "2021-09-02T21:14:55.000Z", "lastUpdatedDate": "2021-09-02T21:14:55.000Z" }, "AmazonEKSConnectorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSConnectorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-04T20:31:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessSSMService", "Effect": "Allow", "Action": [ "ssm:CreateActivation", "ssm:DescribeInstanceInformation", "ssm:DeleteActivation" ], "Resource": "*" }, { "Sid": "ConnectorAgentStartSession", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:eks:*:*:cluster/*", "arn:aws:ssm:*::document/AmazonEKS-ExecuteNonInteractiveCommand" ] }, { "Sid": "ConnectorAgentDeregister", "Effect": "Allow", "Action": [ "ssm:DeregisterManagedInstance" ], "Resource": [ "arn:aws:eks:*:*:cluster/*" ] }, { "Sid": "PassAnyRoleToSsm", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "PutManagedEventRule", "Effect": "Allow", "Action": "events:PutRule", "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "eks-connector.amazonaws.com", "events:source": "aws.ssm" } } }, { "Sid": "PutManagedEventTarget", "Effect": "Allow", "Action": "events:PutTargets", "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "eks-connector.amazonaws.com" } } } ] } } }, "createdDate": "2021-09-04T20:31:08.000Z", "lastUpdatedDate": "2021-09-04T20:31:08.000Z" }, "KafkaConnectServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/KafkaConnectServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-07T13:12:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/AmazonMSKConnectManaged": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": "AmazonMSKConnectManaged" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AmazonMSKConnectManaged": "true" } } } ] } } }, "createdDate": "2021-09-07T13:12:44.000Z", "lastUpdatedDate": "2021-09-07T13:12:44.000Z" }, "AWSQuicksightOpenSearchPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSQuicksightOpenSearchPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-07T23:26:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cluster/settings", "arn:aws:es:*:*:domain/*/_cat/indices" ] }, { "Effect": "Allow", "Action": "es:ListDomainNames", "Resource": "*" }, { "Effect": "Allow", "Action": [ "es:DescribeDomain" ], "Resource": [ "arn:aws:es:*:*:domain/*" ] }, { "Effect": "Allow", "Action": [ "es:ESHttpPost", "es:ESHttpGet" ], "Resource": [ "arn:aws:es:*:*:domain/*/_opendistro/_sql", "arn:aws:es:*:*:domain/*/_plugin/_sql" ] } ] } } }, "createdDate": "2021-09-07T23:26:19.000Z", "lastUpdatedDate": "2021-09-07T23:26:19.000Z" }, "AmazonOpenSearchServiceFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-08T05:33:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:*" ], "Resource": "*" } ] } } }, "createdDate": "2021-09-08T05:33:47.000Z", "lastUpdatedDate": "2021-09-08T05:33:47.000Z" }, "AmazonOpenSearchServiceReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchServiceReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-08T05:38:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "es:Describe*", "es:List*", "es:Get*" ], "Resource": "*" } ] } } }, "createdDate": "2021-09-08T05:38:13.000Z", "lastUpdatedDate": "2021-09-08T05:38:13.000Z" }, "AWSMediaTailorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMediaTailorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-17T22:27:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:*:log-group:MediaTailor/*:log-stream:*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:MediaTailor/*" } ] } } }, "createdDate": "2021-09-17T22:27:10.000Z", "lastUpdatedDate": "2021-09-17T22:27:10.000Z" }, "AmazonMSKConnectReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMSKConnectReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-09-20T10:18:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafkaconnect:ListConnectors" ], "Resource": [ "arn:aws:kafkaconnect:*:*:/*/connectors" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:ListCustomPlugins" ], "Resource": [ "arn:aws:kafkaconnect:*:*:/*/custom-plugins" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:ListWorkerConfigurations" ], "Resource": [ "arn:aws:kafkaconnect:*:*:/*/worker-configurations" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeConnector" ], "Resource": [ "arn:aws:kafkaconnect:*:*:connector/*" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeCustomPlugin" ], "Resource": [ "arn:aws:kafkaconnect:*:*:custom-plugin/*" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeWorkerConfiguration" ], "Resource": [ "arn:aws:kafkaconnect:*:*:worker-configuration/*" ] } ] } }, "v2": { "createdDate": "2021-10-18T09:16:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kafkaconnect:ListConnectors", "kafkaconnect:ListCustomPlugins", "kafkaconnect:ListWorkerConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeConnector" ], "Resource": [ "arn:aws:kafkaconnect:*:*:connector/*" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeCustomPlugin" ], "Resource": [ "arn:aws:kafkaconnect:*:*:custom-plugin/*" ] }, { "Effect": "Allow", "Action": [ "kafkaconnect:DescribeWorkerConfiguration" ], "Resource": [ "arn:aws:kafkaconnect:*:*:worker-configuration/*" ] } ] } } }, "createdDate": "2021-09-20T10:18:43.000Z", "lastUpdatedDate": "2021-10-18T09:16:26.000Z" }, "AmazonConnectCampaignsServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonConnectCampaignsServiceLinkedRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-09-23T20:54:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect-campaigns:ListCampaigns" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-09-23T20:54:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect-campaigns:ListCampaigns" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "connect:BatchPutContact", "connect:StopContact" ], "Resource": "arn:aws:connect:*:*:instance/*" } ] } }, "v3": { "createdDate": "2021-09-23T20:54:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConnectCampaignAccess", "Effect": "Allow", "Action": [ "connect-campaigns:ListCampaigns" ], "Resource": "*" }, { "Sid": "ConnectAccess", "Effect": "Allow", "Action": [ "connect:BatchPutContact", "connect:StopContact", "connect:DescribeContactFlow", "connect:SendOutboundEmail" ], "Resource": "arn:aws:connect:*:*:instance/*" }, { "Sid": "EventBridgeListRuleAccess", "Effect": "Allow", "Action": [ "events:ListRules" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EventBridgeManagedResourceAccess", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/ConnectCampaignsRule*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "events:ManagedBy": "connect-campaigns.amazonaws.com" } } }, { "Sid": "EventBridgeListTargetsByRuleAccess", "Effect": "Allow", "Action": [ "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/ConnectCampaignsRule*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowWisdomForConnectCampaignsEnabledTaggedResources", "Effect": "Allow", "Action": [ "wisdom:GetMessageTemplate", "wisdom:RenderMessageTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonConnectCampaignsEnabled": "True" } } } ] } } }, "createdDate": "2021-09-23T20:54:26.000Z", "lastUpdatedDate": "2024-10-03T20:20:01.000Z" }, "AmazonRedshiftQueryEditorV2FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftQueryEditorV2FullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2022-02-23T17:05:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "KeyManagementServicePermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*" }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2Permissions", "Effect": "Allow", "Action": "sqlworkbench:*", "Resource": "*" } ] } }, "v1": { "createdDate": "2021-09-24T14:06:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "KeyManagementServicePermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*" }, { "Sid": "AmazonRedshiftQueryEditorV2Permissions", "Effect": "Allow", "Action": "sqlworkbench:*", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-09-24T14:06:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups" ], "Resource": "*" }, { "Sid": "KeyManagementServicePermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*" }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2Permissions", "Effect": "Allow", "Action": "sqlworkbench:*", "Resource": "*" } ] } } }, "createdDate": "2021-09-24T14:06:02.000Z", "lastUpdatedDate": "2024-02-21T17:20:52.000Z" }, "AmazonRedshiftQueryEditorV2NoSharing": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftQueryEditorV2NoSharing", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2021-09-24T14:18:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v2": { "createdDate": "2022-02-23T17:04:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v3": { "createdDate": "2022-06-15T09:48:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v5": { "createdDate": "2022-10-17T17:37:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v4": { "createdDate": "2022-08-31T03:59:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v6": { "createdDate": "2023-02-01T20:10:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v7": { "createdDate": "2023-03-21T09:03:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v8": { "createdDate": "2021-09-24T14:18:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v9": { "createdDate": "2021-09-24T14:18:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } } }, "createdDate": "2021-09-24T14:18:42.000Z", "lastUpdatedDate": "2024-02-21T17:25:07.000Z" }, "AmazonRedshiftQueryEditorV2ReadSharing": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftQueryEditorV2ReadSharing", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2021-09-24T14:22:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v2": { "createdDate": "2022-02-23T17:03:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v3": { "createdDate": "2022-06-15T10:16:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v4": { "createdDate": "2022-08-31T04:02:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v5": { "createdDate": "2022-10-17T17:29:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v6": { "createdDate": "2023-02-01T20:09:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v7": { "createdDate": "2023-03-21T08:39:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v8": { "createdDate": "2021-09-24T14:22:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v9": { "createdDate": "2021-09-24T14:22:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } } }, "createdDate": "2021-09-24T14:22:21.000Z", "lastUpdatedDate": "2024-02-21T17:27:40.000Z" }, "AmazonRedshiftQueryEditorV2ReadWriteSharing": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftQueryEditorV2ReadWriteSharing", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2021-09-24T14:25:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v3": { "createdDate": "2022-06-15T10:59:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v2": { "createdDate": "2022-02-23T17:02:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v4": { "createdDate": "2022-08-31T04:01:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v5": { "createdDate": "2022-10-17T16:53:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v6": { "createdDate": "2023-02-01T20:09:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v7": { "createdDate": "2023-03-21T08:20:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v8": { "createdDate": "2021-09-24T14:25:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": "redshift:DescribeClusters", "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } }, "v9": { "createdDate": "2021-09-24T14:25:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftPermissions", "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups" ], "Resource": "*" }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:sqlworkbench!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "ResourceGroupsTaggingPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AmazonRedshiftQueryEditorV2NonResourceLevelPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateFolder", "sqlworkbench:PutTab", "sqlworkbench:BatchDeleteFolder", "sqlworkbench:DeleteTab", "sqlworkbench:GenerateSession", "sqlworkbench:GetAccountInfo", "sqlworkbench:GetAccountSettings", "sqlworkbench:GetUserInfo", "sqlworkbench:GetUserWorkspaceSettings", "sqlworkbench:PutUserWorkspaceSettings", "sqlworkbench:ListConnections", "sqlworkbench:ListFiles", "sqlworkbench:ListTabs", "sqlworkbench:UpdateFolder", "sqlworkbench:ListRedshiftClusters", "sqlworkbench:DriverExecute", "sqlworkbench:ListTaggedResources", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:ListNotebooks", "sqlworkbench:GetSchemaInference", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource" ], "Resource": "*" }, { "Sid": "AmazonRedshiftQueryEditorV2CreateOwnedResourcePermissions", "Effect": "Allow", "Action": [ "sqlworkbench:CreateConnection", "sqlworkbench:CreateSavedQuery", "sqlworkbench:CreateChart", "sqlworkbench:CreateNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2OwnerSpecificPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:DeleteChart", "sqlworkbench:DeleteConnection", "sqlworkbench:DeleteSavedQuery", "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:UpdateFileFolder", "sqlworkbench:ListTagsForResource", "sqlworkbench:GetNotebook", "sqlworkbench:UpdateNotebook", "sqlworkbench:DeleteNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:CreateNotebookCell", "sqlworkbench:DeleteNotebookCell", "sqlworkbench:UpdateNotebookCellContent", "sqlworkbench:UpdateNotebookCellLayout", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:CreateNotebookVersion", "sqlworkbench:GetNotebookVersion", "sqlworkbench:DeleteNotebookVersion", "sqlworkbench:RestoreNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook", "sqlworkbench:ImportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyUserIdPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-resource-owner" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-resource-owner": "${aws:userid}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TeamReadWriteAccessPermissions", "Effect": "Allow", "Action": [ "sqlworkbench:GetChart", "sqlworkbench:GetConnection", "sqlworkbench:GetSavedQuery", "sqlworkbench:ListSavedQueryVersions", "sqlworkbench:ListTagsForResource", "sqlworkbench:UpdateChart", "sqlworkbench:UpdateConnection", "sqlworkbench:UpdateSavedQuery", "sqlworkbench:AssociateConnectionWithTab", "sqlworkbench:AssociateQueryWithTab", "sqlworkbench:AssociateConnectionWithChart", "sqlworkbench:AssociateNotebookWithTab", "sqlworkbench:GetNotebook", "sqlworkbench:DuplicateNotebook", "sqlworkbench:BatchGetNotebookCell", "sqlworkbench:ListNotebookVersions", "sqlworkbench:GetNotebookVersion", "sqlworkbench:CreateNotebookFromVersion", "sqlworkbench:ExportNotebook" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2TagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}", "aws:RequestTag/sqlworkbench-team": "${aws:PrincipalTag/sqlworkbench-team}" } } }, { "Sid": "AmazonRedshiftQueryEditorV2UntagOnlyTeamPermissions", "Effect": "Allow", "Action": "sqlworkbench:UntagResource", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "sqlworkbench-team" }, "StringEquals": { "aws:ResourceTag/sqlworkbench-resource-owner": "${aws:userid}" } } } ] } } }, "createdDate": "2021-09-24T14:25:37.000Z", "lastUpdatedDate": "2024-02-21T17:30:28.000Z" }, "AmazonConnectVoiceIDFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonConnectVoiceIDFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-26T19:04:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "voiceid:*", "Resource": "*" } ] } } }, "createdDate": "2021-09-26T19:04:10.000Z", "lastUpdatedDate": "2021-09-26T19:04:10.000Z" }, "AWSEC2CapacityReservationFleetRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSEC2CapacityReservationFleetRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-09-29T14:43:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeCapacityReservations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateCapacityReservation", "ec2:CancelCapacityReservation", "ec2:ModifyCapacityReservation" ], "Resource": [ "arn:aws:ec2:*:*:capacity-reservation/*" ], "Condition": { "StringLike": { "ec2:CapacityReservationFleet": "arn:aws:ec2:*:*:capacity-reservation-fleet/crf-*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:capacity-reservation/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateCapacityReservation" } } } ] } }, "v2": { "createdDate": "2021-09-29T14:43:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeCapacityReservations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateCapacityReservation", "ec2:CancelCapacityReservation", "ec2:ModifyCapacityReservation" ], "Resource": [ "arn:aws:ec2:*:*:capacity-reservation/*" ], "Condition": { "ArnLike": { "ec2:CapacityReservationFleet": "arn:aws:ec2:*:*:capacity-reservation-fleet/crf-*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:capacity-reservation/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateCapacityReservation" } } } ] } } }, "createdDate": "2021-09-29T14:43:09.000Z", "lastUpdatedDate": "2025-03-03T23:22:06.000Z" }, "AWSAccountManagementFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSAccountManagementFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-30T23:20:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "account:*", "Resource": "*" } ] } } }, "createdDate": "2021-09-30T23:20:37.000Z", "lastUpdatedDate": "2021-09-30T23:20:37.000Z" }, "AWSAccountManagementReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSAccountManagementReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-09-30T23:29:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "account:Get*", "account:List*" ], "Resource": "*" } ] } } }, "createdDate": "2021-09-30T23:29:53.000Z", "lastUpdatedDate": "2021-09-30T23:29:53.000Z" }, "AmazonMemoryDBFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMemoryDBFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-08T19:24:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "memorydb:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/memorydb.amazonaws.com/AWSServiceRoleForMemoryDB", "Condition": { "StringLike": { "iam:AWSServiceName": "memorydb.amazonaws.com" } } } ] } } }, "createdDate": "2021-10-08T19:24:16.000Z", "lastUpdatedDate": "2021-10-08T19:24:16.000Z" }, "AmazonMemoryDBReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMemoryDBReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-08T19:27:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "memorydb:Describe*", "memorydb:List*" ], "Resource": "*" } ] } } }, "createdDate": "2021-10-08T19:27:28.000Z", "lastUpdatedDate": "2021-10-08T19:27:28.000Z" }, "AmazonRDSCustomServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSCustomServiceRolePolicy", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } } ] } }, "v3": { "createdDate": "2023-02-21T23:14:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-09T22:17:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } } ] } }, "v4": { "createdDate": "2023-03-08T23:32:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-05-29T03:33:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-06-22T23:12:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "eccModifyInstanceAttribute1", "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ], "ec2:Attribute": "InstanceType" } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "eccModifyInstanceAttribute1", "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ], "ec2:Attribute": "InstanceType" } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AWSRDSCustom*", "arn:aws:iam::*:role/service-role/AWSRDSCustom*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "rdscrc", "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "eccModifyInstanceAttribute1", "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ], "ec2:Attribute": "InstanceType" } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress", "CopyImage" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "eccAmi1", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ] }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AWSRDSCustom*", "arn:aws:iam::*:role/service-role/AWSRDSCustom*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "rdscrc", "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "eccModifyInstanceAttribute1", "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ], "ec2:Attribute": "InstanceType" } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress", "CopyImage" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "eccAmi1", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ] }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AWSRDSCustom*", "arn:aws:iam::*:role/service-role/AWSRDSCustom*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:RestoreSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager3", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2021-10-08T21:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "rdscrc", "Effect": "Allow", "Action": [ "rds:CrossRegionCommunication" ], "Resource": "*" }, { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "eccModifyInstanceAttribute1", "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ], "ec2:Attribute": "InstanceType" } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:key-pair/rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:key-pair/rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshot", "CreateSnapshots", "CopySnapshot", "AllocateAddress", "CopyImage" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot4", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver" ] } } }, { "Sid": "eccAmi1", "Effect": "Allow", "Action": [ "ec2:CopyImage" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*" ] }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AWSRDSCustom*", "arn:aws:iam::*:role/service-role/AWSRDSCustom*" ], "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:RestoreSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager3", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-sqlserver", "custom-oracle" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-sqlserver", "custom-oracle" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } } }, "createdDate": "2021-10-08T21:39:12.000Z", "lastUpdatedDate": "2025-03-25T23:22:06.000Z" }, "AmazonRDSCustomPreviewServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSCustomPreviewServiceRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2021-10-08T21:44:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver" ] } } } ] } }, "v2": { "createdDate": "2022-11-08T18:01:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } } ] } }, "v3": { "createdDate": "2023-02-14T23:58:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-04-26T02:01:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-06-23T00:24:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-10-08T21:44:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2021-10-08T21:44:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:RestoreSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager3", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2021-10-08T21:44:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ecc1", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVolumes", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:RegisterImage", "ec2:DeregisterImage", "ec2:DescribeTags", "ec2:DescribeSecurityGroups", "ec2:DescribeVolumesModifications", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:SearchTransitGatewayMulticastGroups", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "ecc2", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile", "ec2:AssociateIamInstanceProfile", "ec2:ReplaceIamInstanceProfileAssociation", "ec2:TerminateInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:RebootInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping", "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping2", "Effect": "Allow", "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:ReleaseAddress" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ecc1scoping3", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances1", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances2", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Sid": "eccRunInstances3", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac", "custom-oracle" ] } } }, { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" }, "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccRunInstances3keyPair1", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:DeleteKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:key-pair/preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccKeyPair2", "Effect": "Allow", "Action": [ "ec2:CreateKeyPair" ], "Resource": [ "arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*", "arn:aws:ec2:*:*:key-pair/preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface1", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccNetworkInterface2", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "eccNetworkInterface3", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag1", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccCreateTag2", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateKeyPair", "RunInstances", "CreateNetworkInterface", "CreateVolume", "CreateSnapshots", "CopySnapshot", "AllocateAddress" ] } } }, { "Sid": "eccVolume1", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume2", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume3", "Effect": "Allow", "Action": [ "ec2:ModifyVolumeAttribute", "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccVolume4snapshot1", "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot2", "Effect": "Allow", "Action": [ "ec2:CopySnapshot", "ec2:CreateSnapshots" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eccSnapshot3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "iam1", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:GetInstanceProfile", "iam:GetRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "*" }, { "Sid": "iam2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWSRDSCustom*", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "cloudtrail1", "Effect": "Allow", "Action": [ "cloudtrail:GetTrailStatus" ], "Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*" }, { "Sid": "cw1", "Effect": "Allow", "Action": [ "cloudwatch:EnableAlarmActions", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw2", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "cw3", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "ssm1", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssm2", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssm3", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "ssm4", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "ssm5", "Effect": "Allow", "Action": [ "ssm:DeleteParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle-rac" ] } } }, { "Sid": "eb1", "Effect": "Allow", "Action": [ "events:PutRule", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb2", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:ListTargetsByRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "eb3", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb4", "Effect": "Allow", "Action": [ "events:PutTargets", "events:EnableRule", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*", "Condition": { "StringLike": { "events:ManagedBy": [ "custom.rds-preview.amazonaws.com" ] } } }, { "Sid": "eb5", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*" }, { "Sid": "secretmanager1", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:CreateSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager2", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:RestoreSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "secretmanager3", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "servicequota1", "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "sqs1", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle" ] } } }, { "Sid": "sqs2", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:DeleteQueue" ], "Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle" ] } } } ] } } }, "createdDate": "2021-10-08T21:44:15.000Z", "lastUpdatedDate": "2025-03-25T22:22:06.000Z" }, "AWSMigrationHubStrategyServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubStrategyServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-19T20:02:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "permissionsForAds", "Effect": "Allow", "Action": [ "discovery:ListConfigurations", "discovery:DescribeConfigurations", "mgh:GetHomeRegion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "permissionsForS3", "Effect": "Allow", "Action": [ "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" } ] } } }, "createdDate": "2021-10-19T20:02:37.000Z", "lastUpdatedDate": "2021-10-19T20:02:37.000Z" }, "AWSMigrationHubStrategyConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubStrategyConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-10-19T20:13:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "migrationhub-strategy:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:CreateBucket", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "discovery:GetDiscoverySummary" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "migrationhub-strategy.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/migrationhub-strategy.amazonaws.com/AWSMigrationHubStrategyServiceRolePolicy*" } ] } }, "v2": { "createdDate": "2022-11-09T00:00:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "migrationhub-strategy:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:CreateBucket", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "discovery:GetDiscoverySummary", "discovery:DescribeTags", "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "migrationhub-strategy.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/migrationhub-strategy.amazonaws.com/AWSMigrationHubStrategyServiceRolePolicy*" } ] } } }, "createdDate": "2021-10-19T20:13:26.000Z", "lastUpdatedDate": "2022-11-09T00:00:06.000Z" }, "AWSMigrationHubStrategyCollector": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubStrategyCollector", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2021-10-19T20:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*" } ] } }, "v2": { "createdDate": "2022-09-28T00:06:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts", "migrationhub-strategy:UpdateCollectorConfiguration" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*" } ] } }, "v3": { "createdDate": "2023-03-02T22:08:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts", "migrationhub-strategy:UpdateCollectorConfiguration" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*" } ] } }, "v4": { "createdDate": "2021-10-19T20:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MHSRAllowS3Resources", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:GetBucketAcl", "s3:CreateBucket", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*" }, { "Sid": "MHSRAllowS3ListBucket", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "MHSRAllowExecuteAPI", "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Sid": "MHSRAllowCollectorAPI", "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts", "migrationhub-strategy:UpdateCollectorConfiguration" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Sid": "MHSRAllowSecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*" } ] } }, "v5": { "createdDate": "2021-10-19T20:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MHSRAllowS3Resources", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:GetBucketAcl", "s3:CreateBucket", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MHSRAllowS3ListBucket", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MHSRAllowMetricsAndLogs", "Effect": "Allow", "Action": [ "application-transformation:PutMetricData", "application-transformation:PutLogData" ], "Resource": "*" }, { "Sid": "MHSRAllowExecuteAPI", "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Sid": "MHSRAllowCollectorAPI", "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts", "migrationhub-strategy:UpdateCollectorConfiguration" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Sid": "MHSRAllowSecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v6": { "createdDate": "2021-10-19T20:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MHSRAllowS3Resources", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:GetBucketAcl", "s3:CreateBucket", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketVersioning", "s3:PutLifecycleConfiguration", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::migrationhub-strategy-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MHSRAllowS3ListBucket", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MHSRAllowMetricsAndLogs", "Effect": "Allow", "Action": [ "application-transformation:PutMetricData", "application-transformation:PutLogData", "application-transformation:StartPortingCompatibilityAssessment", "application-transformation:GetPortingCompatibilityAssessment", "application-transformation:StartPortingRecommendationAssessment", "application-transformation:GetPortingRecommendationAssessment" ], "Resource": "*" }, { "Sid": "MHSRAllowExecuteAPI", "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Sid": "MHSRAllowCollectorAPI", "Effect": "Allow", "Action": [ "migrationhub-strategy:RegisterCollector", "migrationhub-strategy:GetAntiPattern", "migrationhub-strategy:GetMessage", "migrationhub-strategy:SendMessage", "migrationhub-strategy:ListAntiPatterns", "migrationhub-strategy:ListJarArtifacts", "migrationhub-strategy:UpdateCollectorConfiguration", "migrationhub-strategy:PutLogData", "migrationhub-strategy:PutMetricData" ], "Resource": "arn:aws:migrationhub-strategy:*:*:*" }, { "Sid": "MHSRAllowSecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-strategy-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2021-10-19T20:15:15.000Z", "lastUpdatedDate": "2024-04-01T16:21:02.000Z" }, "AWSPanoramaServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSPanoramaServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-20T12:12:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaIoTThingAccess", "Effect": "Allow", "Action": [ "iot:CreateThing", "iot:DeleteThing", "iot:DeleteThingShadow", "iot:DescribeThing", "iot:GetThingShadow", "iot:UpdateThing", "iot:UpdateThingShadow" ], "Resource": [ "arn:aws:iot:*:*:thing/panorama*" ] }, { "Sid": "PanoramaIoTCertificateAccess", "Effect": "Allow", "Action": [ "iot:AttachThingPrincipal", "iot:DetachThingPrincipal", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:AttachPrincipalPolicy", "iot:DetachPrincipalPolicy" ], "Resource": [ "arn:aws:iot:*:*:thing/panorama*", "arn:aws:iot:*:*:cert/*" ] }, { "Sid": "PanoramaIoTCreateCertificateAccess", "Effect": "Allow", "Action": [ "iot:CreateKeysAndCertificate" ], "Resource": [ "*" ] }, { "Sid": "PanoramaIoTCreatePolicyAndVersionAccess", "Effect": "Allow", "Action": [ "iot:CreatePolicy", "iot:CreatePolicyVersion", "iot:AttachPolicy" ], "Resource": [ "arn:aws:iot:*:*:policy/panorama*" ] }, { "Sid": "PanoramaIoTJobAccess", "Effect": "Allow", "Action": [ "iot:DescribeJobExecution", "iot:CreateJob", "iot:DeleteJob" ], "Resource": [ "arn:aws:iot:*:*:job/panorama*", "arn:aws:iot:*:*:thing/panorama*" ] }, { "Sid": "PanoramaIoTEndpointAccess", "Effect": "Allow", "Action": [ "iot:DescribeEndpoint" ], "Resource": [ "*" ] }, { "Sid": "PanoramaReadOnlyAccess", "Effect": "Allow", "Action": [ "panorama:Describe*", "panorama:List*" ], "Resource": [ "*" ] }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:DeleteSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:panorama*", "arn:aws:secretsmanager:*:*:secret:Panorama*" ] } ] } } }, "createdDate": "2021-10-20T12:12:50.000Z", "lastUpdatedDate": "2021-10-20T12:12:50.000Z" }, "AWSPanoramaApplianceServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSPanoramaApplianceServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-10-20T12:14:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaDeviceCreateLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDeviceCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDevicePutMetric", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "PanoramaDeviceMetrics" } } }, { "Sid": "PanoramaDeviceS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } } ] } }, "v2": { "createdDate": "2023-01-17T21:32:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaDeviceCreateLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDeviceCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDevicePutMetric", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "PanoramaDeviceMetrics" } } }, { "Sid": "PanoramaDeviceS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetObjectVersion" ], "Resource": [ "arn:aws:s3:::*-nodepackage-store-*", "arn:aws:s3:::*-application-payload-store-*", "arn:aws:s3:*:*:accesspoint/panorama*" ], "Condition": { "StringLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } } ] } }, "v3": { "createdDate": "2021-10-20T12:14:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PanoramaDeviceCreateLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*:log-stream:*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDeviceCreateLogGroup", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": [ "arn:aws:logs:*:*:log-group:/aws/panorama_device*", "arn:aws:logs:*:*:log-group:/aws/panorama/devices/*" ] }, { "Sid": "PanoramaDevicePutMetric", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "PanoramaDeviceMetrics" } } }, { "Sid": "PanoramaDeviceS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:GetObjectVersion" ], "Resource": [ "arn:aws:s3:::*-nodepackage-store-*", "arn:aws:s3:::*-application-payload-store-*", "arn:aws:s3:*:*:accesspoint/panorama*" ], "Condition": { "ArnLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/panorama*" } } } ] } } }, "createdDate": "2021-10-20T12:14:03.000Z", "lastUpdatedDate": "2024-12-10T20:06:11.000Z" }, "AWSMarketplacePurchaseOrdersServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplacePurchaseOrdersServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-27T15:12:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPurchaseOrderActions", "Effect": "Allow", "Action": [ "purchase-orders:ViewPurchaseOrders", "purchase-orders:ModifyPurchaseOrders" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2021-10-27T15:12:37.000Z", "lastUpdatedDate": "2021-10-27T15:12:37.000Z" }, "AWSDeepRacerAccountAdminAccess": { "arn": "arn:aws:iam::aws:policy/AWSDeepRacerAccountAdminAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-28T01:27:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeepRacerAdminAccessStatement", "Effect": "Allow", "Action": [ "deepracer:*" ], "Resource": [ "*" ], "Condition": { "Null": { "deepracer:UserToken": "true" } } } ] } } }, "createdDate": "2021-10-28T01:27:13.000Z", "lastUpdatedDate": "2021-10-28T01:27:13.000Z" }, "AWSDeepRacerDefaultMultiUserAccess": { "arn": "arn:aws:iam::aws:policy/AWSDeepRacerDefaultMultiUserAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-10-28T01:27:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "deepracer:Add*", "deepracer:Remove*", "deepracer:Create*", "deepracer:Perform*", "deepracer:Clone*", "deepracer:Get*", "deepracer:List*", "deepracer:Edit*", "deepracer:Start*", "deepracer:Set*", "deepracer:Update*", "deepracer:Delete*", "deepracer:Stop*", "deepracer:Import*", "deepracer:Tag*", "deepracer:Untag*" ], "Resource": [ "*" ], "Condition": { "Null": { "deepracer:UserToken": "false" }, "Bool": { "deepracer:MultiUser": "true" } } }, { "Effect": "Allow", "Action": [ "deepracer:GetAccountConfig", "deepracer:GetTrack", "deepracer:ListTracks", "deepracer:TestRewardFunction" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "deepracer:Admin*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2021-10-28T01:27:13.000Z", "lastUpdatedDate": "2021-10-28T01:27:13.000Z" }, "AWSCostAndUsageReportAutomationPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSCostAndUsageReportAutomationPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-01T21:27:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketTagging", "s3:PutBucketTagging", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:ListBucket", "s3:CreateBucket" ], "Resource": "arn:aws:s3:::aws-map-cur-bucket-*" }, { "Effect": "Allow", "Action": [ "cur:PutReportDefinition", "cur:DeleteReportDefinition", "cur:DescribeReportDefinitions" ], "Resource": "arn:aws:cur:*:*:definition/map-migrated-report" }, { "Effect": "Allow", "Action": "cur:DescribeReportDefinitions", "Resource": "*" } ] } } }, "createdDate": "2021-11-01T21:27:29.000Z", "lastUpdatedDate": "2021-11-01T21:27:29.000Z" }, "AmazonRedshiftAllCommandsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRedshiftAllCommandsFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-04T00:48:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTransformJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopTrainingJob", "sagemaker:DescribeEndpoint", "sagemaker:InvokeEndpoint", "sagemaker:StopProcessingJob", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:model/*redshift*", "arn:aws:sagemaker:*:*:training-job/*redshift*", "arn:aws:sagemaker:*:*:automl-job/*redshift*", "arn:aws:sagemaker:*:*:compilation-job/*redshift*", "arn:aws:sagemaker:*:*:processing-job/*redshift*", "arn:aws:sagemaker:*:*:transform-job/*redshift*", "arn:aws:sagemaker:*:*:endpoint/*redshift*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/Endpoints/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/ProcessingJobs/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/TrainingJobs/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/TransformJobs/*redshift*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "SageMaker", "/aws/sagemaker/Endpoints", "/aws/sagemaker/ProcessingJobs", "/aws/sagemaker/TrainingJobs", "/aws/sagemaker/TransformJobs" ] } } }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetEncryptionConfiguration", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:PutObject", "s3:PutBucketAcl", "s3:PutBucketCors", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::redshift-downloads", "arn:aws:s3:::redshift-downloads/*", "arn:aws:s3:::*redshift*", "arn:aws:s3:::*redshift*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetEncryptionConfiguration", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:PutObject", "s3:PutBucketAcl", "s3:PutBucketCors", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:Getitem" ], "Resource": [ "arn:aws:dynamodb:*:*:table/*redshift*", "arn:aws:dynamodb:*:*:table/*redshift*/index/*" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:ListInstances" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*redshift*" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:ListInstances" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "elasticmapreduce:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:*redshift*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "arn:aws:glue:*:*:table/*redshift*/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*redshift*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:*redshift*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "redshift.amazonaws.com", "glue.amazonaws.com", "sagemaker.amazonaws.com", "athena.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2021-11-25T02:27:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTransformJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopTrainingJob", "sagemaker:DescribeEndpoint", "sagemaker:InvokeEndpoint", "sagemaker:StopProcessingJob", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:model/*redshift*", "arn:aws:sagemaker:*:*:training-job/*redshift*", "arn:aws:sagemaker:*:*:automl-job/*redshift*", "arn:aws:sagemaker:*:*:compilation-job/*redshift*", "arn:aws:sagemaker:*:*:processing-job/*redshift*", "arn:aws:sagemaker:*:*:transform-job/*redshift*", "arn:aws:sagemaker:*:*:endpoint/*redshift*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/Endpoints/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/ProcessingJobs/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/TrainingJobs/*redshift*", "arn:aws:logs:*:*:log-group:/aws/sagemaker/TransformJobs/*redshift*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "SageMaker", "/aws/sagemaker/Endpoints", "/aws/sagemaker/ProcessingJobs", "/aws/sagemaker/TrainingJobs", "/aws/sagemaker/TransformJobs" ] } } }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetEncryptionConfiguration", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:PutObject", "s3:PutBucketAcl", "s3:PutBucketCors", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::redshift-downloads", "arn:aws:s3:::redshift-downloads/*", "arn:aws:s3:::*redshift*", "arn:aws:s3:::*redshift*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:Getitem" ], "Resource": [ "arn:aws:dynamodb:*:*:table/*redshift*", "arn:aws:dynamodb:*:*:table/*redshift*/index/*" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:ListInstances" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*redshift*" ] }, { "Effect": "Allow", "Action": [ "elasticmapreduce:ListInstances" ], "Resource": "*", "Condition": { "StringEqualsIgnoreCase": { "elasticmapreduce:ResourceTag/Redshift": "true" } } }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:*redshift*" }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "arn:aws:glue:*:*:table/*redshift*/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*redshift*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:*redshift*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "redshift.amazonaws.com", "glue.amazonaws.com", "sagemaker.amazonaws.com", "athena.amazonaws.com" ] } } } ] } } }, "createdDate": "2021-11-04T00:48:08.000Z", "lastUpdatedDate": "2021-11-25T02:27:31.000Z" }, "AWSApplicationMigrationVCenterClientPolicy": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationVCenterClientPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-08T12:53:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:CreateVcenterClientForMgn", "mgn:DescribeVcenterClients" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:GetVcenterClientCommandsForMgn", "mgn:SendVcenterClientCommandResultForMgn", "mgn:SendVcenterClientLogsForMgn", "mgn:SendVcenterClientMetricsForMgn", "mgn:DeleteVcenterClient", "mgn:TagResource", "mgn:NotifyVcenterClientStartedForMgn" ], "Resource": "arn:aws:mgn:*:*:vcenter-client/*" } ] } } }, "createdDate": "2021-11-08T12:53:08.000Z", "lastUpdatedDate": "2021-11-08T12:53:08.000Z" }, "AmazonDevOpsGuruOrganizationsAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDevOpsGuruOrganizationsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-15T23:50:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruOrganizationsAccess", "Effect": "Allow", "Action": [ "devops-guru:DescribeOrganizationHealth", "devops-guru:DescribeOrganizationResourceCollectionHealth", "devops-guru:DescribeOrganizationOverview", "devops-guru:ListOrganizationInsights", "devops-guru:SearchOrganizationInsights" ], "Resource": "*" }, { "Sid": "OrganizationsDataAccess", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListChildren", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots" ], "Resource": "arn:aws:organizations::*:" }, { "Sid": "OrganizationsAdminDataAccess", "Effect": "Allow", "Action": [ "organizations:DeregisterDelegatedAdministrator", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "devops-guru.amazonaws.com" ] } } } ] } } }, "createdDate": "2021-11-15T23:50:52.000Z", "lastUpdatedDate": "2021-11-15T23:50:52.000Z" }, "AmazonInspector2ServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", "latestVersionId": "v15", "versionsCount": 15, "versions": { "v1": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v2": { "createdDate": "2022-08-11T18:45:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v3": { "createdDate": "2022-08-15T17:38:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v5": { "createdDate": "2022-11-17T20:32:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v4": { "createdDate": "2022-08-23T13:23:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v6": { "createdDate": "2023-02-15T17:01:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] } ] } }, "v7": { "createdDate": "2023-02-24T17:57:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2023-04-14T14:12:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:*:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v9": { "createdDate": "2023-04-28T18:13:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:*:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:*:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v10": { "createdDate": "2023-05-31T18:30:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:*:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:*:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v11": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:*:ec2:*:*:instance/*", "arn:*:ssm:*:*:document/AmazonInspector2-*", "arn:*:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:*:ssm:*:*:managed-instance/*", "arn:*:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:*:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:*:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v12": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonInspector2-*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToRunInvokeCisSpecificDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation" ], "Resource": [ "arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS" ] }, { "Sid": "AllowToRunCisCommandsToSpecificResources", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToPutCloudwatchMetricData", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Inspector2" } } } ] } }, "v13": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "lambda:ListTags", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonInspector2-*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToRunInvokeCisSpecificDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation" ], "Resource": [ "arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS" ] }, { "Sid": "AllowToRunCisCommandsToSpecificResources", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToPutCloudwatchMetricData", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Inspector2" } } } ] } }, "v14": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "lambda:ListTags", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonInspector2-*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToRunInvokeCisSpecificDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation" ], "Resource": [ "arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS" ] }, { "Sid": "AllowToRunCisCommandsToSpecificResources", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToPutCloudwatchMetricData", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Inspector2" } } }, { "Sid": "AllowListAccessToECSAndEKS", "Effect": "Allow", "Action": [ "ecs:ListClusters", "ecs:ListTasks", "eks:ListClusters" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAccessToECSTasks", "Effect": "Allow", "Action": [ "ecs:DescribeTasks" ], "Resource": "arn:aws:ecs:*:*:cluster/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v15": { "createdDate": "2021-11-16T20:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TirosPolicy", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": [ "*" ] }, { "Sid": "PackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "LambdaPackageVulnerabilityScanning", "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "lambda:ListTags", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "GatherInventory", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:DeleteAssociation", "ssm:UpdateAssociation" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AmazonInspector2-*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "DataSyncCleanup", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource": [ "arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid": "ManagedRules", "Effect": "Allow", "Action": [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid": "LambdaCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource": [ "*" ] }, { "Sid": "CodeGuruCodeVulnerabilityScanning", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "codeguru-security.amazonaws.com" ] } } }, { "Sid": "Ec2DeepInspection", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListServiceLinkedChannels", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToRunInvokeCisSpecificDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation" ], "Resource": [ "arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS" ] }, { "Sid": "AllowToRunCisCommandsToSpecificResources", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToPutCloudwatchMetricData", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Inspector2" } } }, { "Sid": "AllowListAccessToECSAndEKS", "Effect": "Allow", "Action": [ "ecs:ListClusters", "ecs:ListTasks", "eks:ListClusters" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAccessToECSTasks", "Effect": "Allow", "Action": [ "ecs:DescribeTasks" ], "Resource": "arn:aws:ecs:*:*:task/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2021-11-16T20:27:48.000Z", "lastUpdatedDate": "2025-03-28T20:07:06.000Z" }, "AWSElasticDisasterRecoveryRecoveryInstancePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryRecoveryInstancePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2022-10-30T13:17:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:UpdateReplicationCertificateForDrs", "drs:NotifyReplicationServerAuthenticationForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*", "Condition": { "StringEquals": { "drs:EC2InstanceARN": "${ec2:SourceInstanceARN}" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v1": { "createdDate": "2021-11-17T10:20:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:UpdateReplicationCertificateForDrs", "drs:NotifyReplicationServerAuthenticationForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*", "Condition": { "StringEquals": { "drs:EC2InstanceARN": "${ec2:SourceInstanceARN}" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-05-14T07:32:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:UpdateReplicationCertificateForDrs", "drs:NotifyReplicationServerAuthenticationForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*", "Condition": { "StringEquals": { "drs:EC2InstanceARN": "${ec2:SourceInstanceARN}" } } }, { "Effect": "Allow", "Action": [ "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } }, "v4": { "createdDate": "2021-11-17T10:20:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSRecoveryInstancePolicy1", "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:UpdateReplicationCertificateForDrs", "drs:NotifyReplicationServerAuthenticationForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*", "Condition": { "StringEquals": { "drs:EC2InstanceARN": "${ec2:SourceInstanceARN}" } } }, { "Sid": "DRSRecoveryInstancePolicy2", "Effect": "Allow", "Action": [ "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Sid": "DRSRecoveryInstancePolicy3", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "DRSRecoveryInstancePolicy4", "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Sid": "DRSRecoveryInstancePolicy5", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Sid": "DRSRecoveryInstancePolicy6", "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSRecoveryInstancePolicy7", "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } } }, "createdDate": "2021-11-17T10:20:43.000Z", "lastUpdatedDate": "2023-11-27T13:11:08.000Z" }, "AWSElasticDisasterRecoveryAgentPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryAgentPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-17T10:32:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/${aws:SourceIdentity}" } ] } }, "v2": { "createdDate": "2023-03-27T13:47:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/${aws:SourceIdentity}" }, { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-17T10:32:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSAgentPolicy1", "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/${aws:SourceIdentity}" }, { "Sid": "DRSAgentPolicy2", "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-17T10:32:32.000Z", "lastUpdatedDate": "2023-11-27T13:44:15.000Z" }, "AWSElasticDisasterRecoveryAgentInstallationPolicy": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryAgentInstallationPolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2021-11-17T10:37:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" } ] } }, "v3": { "createdDate": "2022-12-28T07:10:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateRecoveryInstanceForDrs" } } }, { "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v2": { "createdDate": "2022-07-03T09:11:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:recovery-instance/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateRecoveryInstanceForDrs" } } }, { "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v4": { "createdDate": "2023-06-13T09:43:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateRecoveryInstanceForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v5": { "createdDate": "2021-11-17T10:37:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateRecoveryInstanceForDrs" } } }, { "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v6": { "createdDate": "2021-11-17T10:37:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSAgentInstallationPolicy1", "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateRecoveryInstanceForDrs", "drs:DescribeRecoveryInstances", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Sid": "DRSAgentInstallationPolicy2", "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Sid": "DRSAgentInstallationPolicy3", "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateRecoveryInstanceForDrs" } } }, { "Sid": "DRSAgentInstallationPolicy4", "Effect": "Allow", "Action": "drs:TagResource", "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Sid": "DRSAgentInstallationPolicy5", "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": "arn:aws:drs:*:*:source-server/*" } ] } } }, "createdDate": "2021-11-17T10:37:54.000Z", "lastUpdatedDate": "2023-11-27T12:38:51.000Z" }, "AWSElasticDisasterRecoveryFailbackPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryFailbackPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-17T10:41:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:DescribeReplicationServerAssociationsForDrs", "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetFailbackCommandForDrs", "drs:UpdateFailbackClientLastSeenForDrs", "drs:NotifyAgentAuthenticationForDrs", "drs:UpdateAgentReplicationProcessStateForDrs", "drs:NotifyAgentReplicationProgressForDrs", "drs:NotifyAgentConnectedForDrs", "drs:NotifyAgentDisconnectedForDrs", "drs:NotifyConsistencyAttainedForDrs", "drs:GetFailbackLaunchRequestedForDrs", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/${aws:SourceIdentity}" } ] } }, "v2": { "createdDate": "2021-11-17T10:41:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSFailbackPolicy1", "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Sid": "DRSFailbackPolicy2", "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" }, { "Sid": "DRSFailbackPolicy3", "Effect": "Allow", "Action": [ "drs:DescribeReplicationServerAssociationsForDrs", "drs:DescribeRecoveryInstances" ], "Resource": "*" }, { "Sid": "DRSFailbackPolicy4", "Effect": "Allow", "Action": [ "drs:GetFailbackCommandForDrs", "drs:UpdateFailbackClientLastSeenForDrs", "drs:NotifyAgentAuthenticationForDrs", "drs:UpdateAgentReplicationProcessStateForDrs", "drs:NotifyAgentReplicationProgressForDrs", "drs:NotifyAgentConnectedForDrs", "drs:NotifyAgentDisconnectedForDrs", "drs:NotifyConsistencyAttainedForDrs", "drs:GetFailbackLaunchRequestedForDrs", "drs:IssueAgentCertificateForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/${aws:SourceIdentity}" } ] } } }, "createdDate": "2021-11-17T10:41:40.000Z", "lastUpdatedDate": "2023-11-27T12:56:46.000Z" }, "AWSElasticDisasterRecoveryConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryConsoleFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2021-11-17T10:46:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListInstanceProfiles", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v2": { "createdDate": "2022-05-29T08:40:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } } ] } }, "v3": { "createdDate": "2023-04-19T09:52:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } } ] } }, "v4": { "createdDate": "2023-06-11T08:37:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-17T10:46:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2021-11-17T10:46:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess30", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } } }, "createdDate": "2021-11-17T10:46:29.000Z", "lastUpdatedDate": "2025-01-12T07:52:06.000Z" }, "AWSElasticDisasterRecoveryReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-11-17T10:50:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-05-29T08:27:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" } ] } }, "v3": { "createdDate": "2021-11-17T10:50:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "drs:ListLaunchActions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:ListCommandInvocations", "Resource": "*" }, { "Effect": "Allow", "Action": "ssm:GetParameter", "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-CreateImage", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ] }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v4": { "createdDate": "2021-11-17T10:50:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSReadOnlyAccess1", "Effect": "Allow", "Action": [ "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "drs:ListLaunchActions" ], "Resource": "*" }, { "Sid": "DRSReadOnlyAccess2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DRSReadOnlyAccess4", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "DRSReadOnlyAccess5", "Effect": "Allow", "Action": "ssm:ListCommandInvocations", "Resource": "*" }, { "Sid": "DRSReadOnlyAccess6", "Effect": "Allow", "Action": "ssm:GetParameter", "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" }, { "Sid": "DRSReadOnlyAccess7", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-CreateImage", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ] }, { "Sid": "DRSReadOnlyAccess8", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v5": { "createdDate": "2021-11-17T10:50:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSReadOnlyAccess1", "Effect": "Allow", "Action": [ "drs:DescribeJobLogItems", "drs:DescribeJobs", "drs:DescribeRecoveryInstances", "drs:DescribeRecoverySnapshots", "drs:DescribeReplicationConfigurationTemplates", "drs:DescribeSourceServers", "drs:GetFailbackReplicationConfiguration", "drs:GetLaunchConfiguration", "drs:GetReplicationConfiguration", "drs:ListExtensibleSourceServers", "drs:ListStagingAccounts", "drs:ListTagsForResource", "drs:ListLaunchActions" ], "Resource": "*" }, { "Sid": "DRSReadOnlyAccess2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:GetInstanceTypesFromInstanceRequirements" ], "Resource": "*" }, { "Sid": "DRSReadOnlyAccess4", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "DRSReadOnlyAccess5", "Effect": "Allow", "Action": "ssm:ListCommandInvocations", "Resource": "*" }, { "Sid": "DRSReadOnlyAccess6", "Effect": "Allow", "Action": "ssm:GetParameter", "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" }, { "Sid": "DRSReadOnlyAccess7", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-CreateImage", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ] }, { "Sid": "DRSReadOnlyAccess8", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } } }, "createdDate": "2021-11-17T10:50:05.000Z", "lastUpdatedDate": "2024-07-29T19:39:26.000Z" }, "AWSElasticDisasterRecoveryServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSElasticDisasterRecoveryServiceRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v2": { "createdDate": "2022-07-10T12:44:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-11T08:33:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v4": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSServiceRolePolicy1", "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Sid": "DRSServiceRolePolicy3", "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSServiceRolePolicy4", "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy5", "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy6", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy7", "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy8", "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy11", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy12", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy13", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy14", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy15", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy16", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "DRSServiceRolePolicy17", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy21", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy22", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Sid": "DRSServiceRolePolicy23", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "DRSServiceRolePolicy25", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "DRSServiceRolePolicy26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Sid": "DRSServiceRolePolicy27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy28", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v5": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSServiceRolePolicy1", "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Sid": "DRSServiceRolePolicy3", "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSServiceRolePolicy4", "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy5", "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy6", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy7", "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy8", "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy11", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy12", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy13", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy14", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy15", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy16", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "DRSServiceRolePolicy17", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy21", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy22", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Sid": "DRSServiceRolePolicy23", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "DRSServiceRolePolicy25", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "DRSServiceRolePolicy26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Sid": "DRSServiceRolePolicy27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy28", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v6": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSServiceRolePolicy1", "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Sid": "DRSServiceRolePolicy3", "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSServiceRolePolicy4", "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy5", "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy6", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:GetManagedPrefixListAssociations" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy7", "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy8", "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy11", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy12", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy13", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy14", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy15", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy16", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "DRSServiceRolePolicy17", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy21", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy22", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Sid": "DRSServiceRolePolicy23", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "DRSServiceRolePolicy25", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "DRSServiceRolePolicy26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Sid": "DRSServiceRolePolicy27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy28", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v7": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSServiceRolePolicy1", "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Sid": "DRSServiceRolePolicy3", "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSServiceRolePolicy4", "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy5", "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy6", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeAttribute", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:GetManagedPrefixListAssociations" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy7", "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy8", "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy11", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy12", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy13", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy14", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy15", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy16", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "DRSServiceRolePolicy17", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy21", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy22", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Sid": "DRSServiceRolePolicy23", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "DRSServiceRolePolicy25", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "DRSServiceRolePolicy26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] } } }, { "Sid": "DRSServiceRolePolicy27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy28", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } }, "v8": { "createdDate": "2021-11-17T10:56:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSServiceRolePolicy1", "Effect": "Allow", "Action": [ "drs:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" }, { "Sid": "DRSServiceRolePolicy3", "Effect": "Allow", "Action": [ "drs:CreateRecoveryInstanceForDrs", "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSServiceRolePolicy4", "Effect": "Allow", "Action": "iam:GetInstanceProfile", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy5", "Effect": "Allow", "Action": "kms:ListRetirableGrants", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy6", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeAttribute", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeDhcpOptions", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:GetManagedPrefixListAssociations", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy7", "Effect": "Allow", "Action": [ "ec2:RegisterImage" ], "Resource": "*" }, { "Sid": "DRSServiceRolePolicy8", "Effect": "Allow", "Action": [ "ec2:DeregisterImage" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy11", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy12", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy13", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy14", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy15", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy16", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "DRSServiceRolePolicy17", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy21", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy22", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Sid": "DRSServiceRolePolicy23", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "DRSServiceRolePolicy25", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "DRSServiceRolePolicy26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate", "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateNetworkInterface" ] } } }, { "Sid": "DRSServiceRolePolicy27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy28", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "DRSServiceRolePolicy29", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy30", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy31", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "DRSServiceRolePolicy32", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSServiceRolePolicy33", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2021-11-17T10:56:17.000Z", "lastUpdatedDate": "2025-01-05T14:07:06.000Z" }, "AWSElasticDisasterRecoveryFailbackInstallationPolicy": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryFailbackInstallationPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-17T11:02:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:DescribeRecoveryInstances", "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource", "drs:IssueAgentCertificateForDrs", "drs:AssociateFailbackClientToRecoveryInstanceForDrs", "drs:GetSuggestedFailbackClientDeviceMappingForDrs", "drs:UpdateFailbackClientDeviceMappingForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" } ] } }, "v2": { "createdDate": "2022-06-27T09:13:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:DescribeRecoveryInstances", "drs:DescribeSourceServers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource", "drs:IssueAgentCertificateForDrs", "drs:AssociateFailbackClientToRecoveryInstanceForDrs", "drs:GetSuggestedFailbackClientDeviceMappingForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateFailbackClientDeviceMappingForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" } ] } }, "v3": { "createdDate": "2021-11-17T11:02:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSFailbackInstallationPolicy1", "Effect": "Allow", "Action": [ "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:DescribeRecoveryInstances", "drs:DescribeSourceServers" ], "Resource": "*" }, { "Sid": "DRSFailbackInstallationPolicy2", "Effect": "Allow", "Action": [ "drs:TagResource", "drs:IssueAgentCertificateForDrs", "drs:AssociateFailbackClientToRecoveryInstanceForDrs", "drs:GetSuggestedFailbackClientDeviceMappingForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateFailbackClientDeviceMappingForDrs" ], "Resource": "arn:aws:drs:*:*:recovery-instance/*" } ] } } }, "createdDate": "2021-11-17T11:02:03.000Z", "lastUpdatedDate": "2023-11-27T13:43:08.000Z" }, "AWSElasticDisasterRecoveryReplicationServerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryReplicationServerPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-17T13:34:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetAgentSnapshotCreditsForDrs", "drs:DescribeReplicationServerAssociationsForDrs", "drs:DescribeSnapshotRequestsForDrs", "drs:BatchDeleteSnapshotRequestForDrs", "drs:NotifyAgentAuthenticationForDrs", "drs:BatchCreateVolumeSnapshotGroupForDrs", "drs:UpdateAgentReplicationProcessStateForDrs", "drs:NotifyAgentReplicationProgressForDrs", "drs:NotifyAgentConnectedForDrs", "drs:NotifyAgentDisconnectedForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } } ] } }, "v2": { "createdDate": "2022-07-10T12:34:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetAgentSnapshotCreditsForDrs", "drs:DescribeReplicationServerAssociationsForDrs", "drs:DescribeSnapshotRequestsForDrs", "drs:BatchDeleteSnapshotRequestForDrs", "drs:NotifyAgentAuthenticationForDrs", "drs:BatchCreateVolumeSnapshotGroupForDrs", "drs:UpdateAgentReplicationProcessStateForDrs", "drs:NotifyAgentReplicationProgressForDrs", "drs:NotifyAgentConnectedForDrs", "drs:NotifyAgentDisconnectedForDrs", "drs:NotifyVolumeEventForDrs", "drs:SendVolumeStatsForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } } ] } }, "v3": { "createdDate": "2021-11-17T13:34:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSReplicationServerPolicy1", "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Sid": "DRSReplicationServerPolicy2", "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" }, { "Sid": "DRSReplicationServerPolicy3", "Effect": "Allow", "Action": [ "drs:GetAgentSnapshotCreditsForDrs", "drs:DescribeReplicationServerAssociationsForDrs", "drs:DescribeSnapshotRequestsForDrs", "drs:BatchDeleteSnapshotRequestForDrs", "drs:NotifyAgentAuthenticationForDrs", "drs:BatchCreateVolumeSnapshotGroupForDrs", "drs:UpdateAgentReplicationProcessStateForDrs", "drs:NotifyAgentReplicationProgressForDrs", "drs:NotifyAgentConnectedForDrs", "drs:NotifyAgentDisconnectedForDrs", "drs:NotifyVolumeEventForDrs", "drs:SendVolumeStatsForDrs" ], "Resource": "*" }, { "Sid": "DRSReplicationServerPolicy4", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Sid": "DRSReplicationServerPolicy5", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSReplicationServerPolicy6", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSReplicationServerPolicy7", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } } ] } } }, "createdDate": "2021-11-17T13:34:00.000Z", "lastUpdatedDate": "2023-11-27T13:28:14.000Z" }, "AWSElasticDisasterRecoveryConversionServerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryConversionServerPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-17T13:42:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-17T13:42:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSConversionServerPolicy1", "Effect": "Allow", "Action": [ "drs:SendClientMetricsForDrs", "drs:SendClientLogsForDrs" ], "Resource": "*" }, { "Sid": "DRSConversionServerPolicy2", "Effect": "Allow", "Action": [ "drs:GetChannelCommandsForDrs", "drs:SendChannelCommandResultForDrs" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-17T13:42:23.000Z", "lastUpdatedDate": "2023-11-27T13:13:38.000Z" }, "AWSShieldServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSShieldServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-17T19:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSShield", "Effect": "Allow", "Action": [ "wafv2:GetWebACL", "wafv2:UpdateWebACL", "wafv2:GetWebACLForResource", "wafv2:ListResourcesForWebACL", "cloudfront:ListDistributions", "cloudfront:GetDistribution" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-17T19:17:46.000Z", "lastUpdatedDate": "2021-11-17T19:17:46.000Z" }, "AmazonCloudWatchRUMServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonCloudWatchRUMServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-17T23:17:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2022-10-26T21:33:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RUM" } } } ] } }, "v3": { "createdDate": "2023-02-22T20:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": [ "RUM/CustomMetrics/*", "AWS/RUM" ] } } } ] } } }, "createdDate": "2021-11-17T23:17:23.000Z", "lastUpdatedDate": "2023-02-22T20:35:15.000Z" }, "AmazonDetectiveServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonDetectiveServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-18T19:47:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:ListAccounts" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-18T19:47:32.000Z", "lastUpdatedDate": "2021-11-18T19:47:32.000Z" }, "AmazonGrafanaAthenaAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonGrafanaAthenaAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-22T17:11:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": [ "*" ], "Condition": { "Null": { "aws:ResourceTag/GrafanaDataSource": "false" } } }, { "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock" ], "Resource": [ "arn:aws:s3:::grafana-athena-query-results-*" ] } ] } } }, "createdDate": "2021-11-22T17:11:11.000Z", "lastUpdatedDate": "2021-11-22T17:11:11.000Z" }, "AWSElementalMediaTailorFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaTailorFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-23T00:04:39.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "mediatailor:*", "Resource": "*" } } } }, "createdDate": "2021-11-23T00:04:39.000Z", "lastUpdatedDate": "2021-11-23T00:04:39.000Z" }, "AWSElementalMediaTailorReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaTailorReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-23T00:05:01.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "mediatailor:List*", "mediatailor:Describe*", "mediatailor:Get*" ], "Resource": "*" } } } }, "createdDate": "2021-11-23T00:05:01.000Z", "lastUpdatedDate": "2021-11-23T00:05:01.000Z" }, "AWSProtonSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSProtonSyncServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-23T21:14:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SyncToProton", "Effect": "Allow", "Action": [ "proton:UpdateServiceTemplateVersion", "proton:UpdateServiceTemplate", "proton:UpdateEnvironmentTemplateVersion", "proton:UpdateEnvironmentTemplate", "proton:GetServiceTemplateVersion", "proton:GetServiceTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetEnvironmentTemplate", "proton:DeleteServiceTemplateVersion", "proton:DeleteEnvironmentTemplateVersion", "proton:CreateServiceTemplateVersion", "proton:CreateServiceTemplate", "proton:CreateEnvironmentTemplateVersion", "proton:CreateEnvironmentTemplate", "proton:ListEnvironmentTemplateVersions", "proton:ListServiceTemplateVersions", "proton:CreateEnvironmentTemplateMajorVersion", "proton:CreateServiceTemplateMajorVersion" ], "Resource": "*" }, { "Sid": "AccessGitRepos", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" } ] } }, "v2": { "createdDate": "2021-11-23T21:14:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SyncToProton", "Effect": "Allow", "Action": [ "proton:UpdateServiceTemplateVersion", "proton:UpdateServiceTemplate", "proton:UpdateEnvironmentTemplateVersion", "proton:UpdateEnvironmentTemplate", "proton:GetServiceTemplateVersion", "proton:GetServiceTemplate", "proton:GetEnvironmentTemplateVersion", "proton:GetEnvironmentTemplate", "proton:DeleteServiceTemplateVersion", "proton:DeleteEnvironmentTemplateVersion", "proton:CreateServiceTemplateVersion", "proton:CreateServiceTemplate", "proton:CreateEnvironmentTemplateVersion", "proton:CreateEnvironmentTemplate", "proton:ListEnvironmentTemplateVersions", "proton:ListServiceTemplateVersions", "proton:CreateEnvironmentTemplateMajorVersion", "proton:CreateServiceTemplateMajorVersion" ], "Resource": "*" }, { "Sid": "AccessGitRepos", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] } ] } } }, "createdDate": "2021-11-23T21:14:36.000Z", "lastUpdatedDate": "2024-05-05T01:49:07.000Z" }, "AmazonBraketJobsExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonBraketJobsExecutionPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2021-11-28T05:34:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "braket:CancelJob", "braket:CancelQuantumTask", "braket:CreateJob", "braket:CreateQuantumTask", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "braket:ListTagsForResource", "braket:TagResource", "braket:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:StartQuery", "logs:StopQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } }, "v1": { "createdDate": "2021-11-26T19:34:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::amazon-braket-*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability" ], "Resource": "arn:aws:ecr:*:*:repository/amazon-braket*" }, { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "braket:CancelJob", "braket:CancelQuantumTask", "braket:CreateJob", "braket:CreateQuantumTask", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "braket:ListTagsForResource", "braket:TagResource", "braket:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBraketJobsExecutionRole*", "Condition": { "StringLike": { "iam:PassedToService": [ "braket.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:StartQuery", "logs:StopQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/braket*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/braket" } } } ] } } }, "createdDate": "2021-11-26T19:34:41.000Z", "lastUpdatedDate": "2021-11-28T05:34:55.000Z" }, "AWSECRPullThroughCache_ServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSECRPullThroughCache_ServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-26T21:51:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2021-11-26T21:51:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECR", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" }, { "Sid": "SecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:ecr-pullthroughcache/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v3": { "createdDate": "2021-11-26T21:51:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ECR", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:BatchGetImage", "ecr:BatchImportUpstreamImage", "ecr:GetDownloadUrlForLayer", "ecr:GetImageCopyStatus" ], "Resource": "*" }, { "Sid": "SecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:ecr-pullthroughcache/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2021-11-26T21:51:09.000Z", "lastUpdatedDate": "2025-03-06T21:22:07.000Z" }, "AmazonGrafanaRedshiftAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonGrafanaRedshiftAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-26T23:15:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift:DescribeClusters", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:ListTables", "redshift-data:ListSchemas" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/GrafanaDataSource": "false" } } }, { "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbname:*/*", "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "Null": { "secretsmanager:ResourceTag/RedshiftQueryOwner": "false" } } } ] } } }, "createdDate": "2021-11-26T23:15:15.000Z", "lastUpdatedDate": "2021-11-26T23:15:15.000Z" }, "AWSIotRoboRunnerReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSIotRoboRunnerReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-29T03:43:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotroborunner:GetTask", "iotroborunner:ListActivities", "iotroborunner:GetSite", "iotroborunner:GetDestinationRelationship", "iotroborunner:GetWorker", "iotroborunner:ListTasks", "iotroborunner:GetAction", "iotroborunner:GetActivity", "iotroborunner:ListDestinationRelationships", "iotroborunner:ListActionTemplates", "iotroborunner:ListWorkerFleets", "iotroborunner:ListSites", "iotroborunner:ListActions", "iotroborunner:ListWorkers", "iotroborunner:GetDestination", "iotroborunner:GetActionTemplate", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-16T20:51:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotroborunner:GetSite", "iotroborunner:GetWorker", "iotroborunner:ListWorkerFleets", "iotroborunner:ListSites", "iotroborunner:ListWorkers", "iotroborunner:GetDestination", "iotroborunner:GetWorkerFleet", "iotroborunner:ListDestinations" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-29T03:43:32.000Z", "lastUpdatedDate": "2022-11-16T20:51:43.000Z" }, "AWSIotRoboRunnerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIotRoboRunnerFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-29T03:54:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iotroborunner:*", "Resource": "*" } ] } }, "v2": { "createdDate": "2023-02-23T18:34:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iotroborunner:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/iotroborunner.amazonaws.com/AWSServiceRoleForIoTRoboRunner", "Condition": { "StringEquals": { "iam:AWSServiceName": "iotroborunner.amazonaws.com" } } } ] } } }, "createdDate": "2021-11-29T03:54:37.000Z", "lastUpdatedDate": "2023-02-23T18:34:44.000Z" }, "AWSMigrationHubRefactorSpacesServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubRefactorSpacesServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2021-11-29T06:50:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeTransitGatewayVpcAttachments", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PUT", "apigateway:POST", "apigateway:GET", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": "arn:aws:apigateway:*::/vpclinks/*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } } ] } }, "v2": { "createdDate": "2022-10-28T18:39:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeTransitGatewayVpcAttachments", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PUT", "apigateway:POST", "apigateway:GET", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": "arn:aws:apigateway:*::/vpclinks/*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeregisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } } ] } }, "v3": { "createdDate": "2023-07-20T15:57:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeTransitGatewayVpcAttachments", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": [ "apigateway:PUT", "apigateway:POST", "apigateway:GET", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": "arn:aws:apigateway:*::/vpclinks/*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": [ "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" ], "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeregisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } } ] } } }, "createdDate": "2021-11-29T06:50:15.000Z", "lastUpdatedDate": "2023-07-20T15:57:53.000Z" }, "AWSMigrationHubRefactorSpacesFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubRefactorSpacesFullAccess", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2021-11-29T07:12:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeTransitGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2021-11-29T14:07:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeTransitGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-03-21T17:41:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeTransitGateways", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2022-10-06T19:05:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2023-07-19T19:07:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": [ "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" ], "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v6": { "createdDate": "2021-11-29T07:12:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Sid": "EC2Describe", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Sid": "RequestTagTransitGatewayCreate", "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:environment-id": "false" } } }, { "Sid": "ResourceTagTransitGatewayCreate", "Effect": "Allow", "Action": [ "ec2:CreateTransitGateway", "ec2:CreateSecurityGroup", "ec2:CreateTransitGatewayVpcAttachment" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Sid": "VpcEndpointServiceConfigurationCreate", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Sid": "EC2NetworkingModify", "Effect": "Allow", "Action": [ "ec2:DeleteTransitGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", "ec2:DeleteTransitGatewayVpcAttachment", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Sid": "VpcEndpointServiceConfigurationDelete", "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Sid": "ELBLoadBalancerCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Sid": "ELBDescribe", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Sid": "ELBModify", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Sid": "ELBLoadBalancerDelete", "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Sid": "ELBListenerCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": [ "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" ], "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Sid": "ELBListenerDelete", "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Sid": "ELBTargetGroupModify", "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Sid": "ELBTargetGroupCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Sid": "APIGatewayModify", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Sid": "APIGatewayVpcLinksGet", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "OrganizationDescribe", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "CloudformationStackCreate", "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Sid": "CloudformationStackTag", "Effect": "Allow", "Action": [ "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/*" }, { "Sid": "CreateRefactorSpacesSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Sid": "CreateELBSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } } }, "createdDate": "2021-11-29T07:12:55.000Z", "lastUpdatedDate": "2024-04-11T17:45:46.000Z" }, "AmazonCloudWatchEvidentlyReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudWatchEvidentlyReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-29T15:08:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "evidently:GetExperiment", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-29T15:08:38.000Z", "lastUpdatedDate": "2021-11-29T15:08:38.000Z" }, "AmazonCloudWatchEvidentlyFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudWatchEvidentlyFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-29T15:10:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "evidently:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/CloudWatchRUMEvidentlyRole-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "cloudwatch:TagResource", "cloudwatch:UnTagResource" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect": "Allow", "Action": [ "cloudtrail:LookupEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:Evidently-Alarm-*" ] }, { "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource": [ "arn:*:sns:*:*:Evidently-*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2021-11-29T15:10:14.000Z", "lastUpdatedDate": "2021-11-29T15:10:14.000Z" }, "AmazonCloudWatchRUMReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudWatchRUMReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-29T15:43:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-10-28T18:12:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:ListRumMetricsDestinations", "rum:BatchGetRumMetricDefinitions" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-29T15:43:47.000Z", "lastUpdatedDate": "2022-10-28T18:12:58.000Z" }, "AmazonCloudWatchRUMFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCloudWatchRUMFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-11-29T15:46:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rum:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/rum.amazonaws.com/AWSServiceRoleForRealUserMonitoring" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/RUM-Monitor*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "cognito-identity.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Effect": "Allow", "Action": [ "cognito-identity:CreateIdentityPool", "cognito-identity:ListIdentityPools", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:SetIdentityPoolRoles" ], "Resource": "arn:aws:cognito-identity:*:*:identitypool/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy", "logs:CreateLogStream" ], "Resource": "arn:aws:logs:*:*:log-group:*RUMService*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:DescribeResourcePolicies" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:*:log-group::log-stream:*" }, { "Effect": "Allow", "Action": [ "synthetics:describeCanaries", "synthetics:describeCanariesLastRun" ], "Resource": "arn:aws:synthetics:*:*:canary:*" } ] } } }, "createdDate": "2021-11-29T15:46:12.000Z", "lastUpdatedDate": "2021-11-29T15:46:12.000Z" }, "AmazonInspector2FullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonInspector2FullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2021-11-29T19:10:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "inspector2:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "inspector2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-04-19T21:33:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "inspector2:*", "Resource": "*" }, { "Effect": "Allow", "Action": "codeguru-security:BatchGetFindings", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "inspector2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-08-03T19:28:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "inspector2:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "codeguru-security:BatchGetFindings", "codeguru-security:GetAccountConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "inspector2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2021-11-29T19:10:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFullAccessToInspectorApis", "Effect": "Allow", "Action": "inspector2:*", "Resource": "*" }, { "Sid": "AllowAccessToCodeGuruApis", "Effect": "Allow", "Action": [ "codeguru-security:BatchGetFindings", "codeguru-security:GetAccountConfiguration" ], "Resource": "*" }, { "Sid": "AllowAccessToCreateSlr", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "agentless.inspector2.amazonaws.com", "inspector2.amazonaws.com" ] } } }, { "Sid": "AllowAccessToOrganizationApis", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-29T19:10:15.000Z", "lastUpdatedDate": "2024-04-25T13:21:03.000Z" }, "AmazonWorkSpacesWebServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonWorkSpacesWebServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-11-30T13:15:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/WorkSpacesWeb" } } } ] } }, "v2": { "createdDate": "2022-04-05T22:01:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/WorkSpacesWeb", "AWS/Usage" ] } } } ] } }, "v3": { "createdDate": "2022-09-06T20:46:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "WorkSpacesWebManaged" ] } } }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/WorkSpacesWeb", "AWS/Usage" ] } } } ] } }, "v5": { "createdDate": "2022-12-15T22:46:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaces", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/WorkSpacesWebManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "WorkSpacesWebManaged" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/WorkSpacesWebManaged": "true" } } }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/WorkSpacesWeb", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStreamSummary" ], "Resource": "arn:aws:kinesis:*:*:stream/amazon-workspaces-web-*" } ] } }, "v4": { "createdDate": "2022-10-17T16:43:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "WorkSpacesWebManaged" ] } } }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/WorkSpacesWeb", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStreamSummary" ], "Resource": "arn:aws:kinesis:*:*:stream/amazon-workspaces-web-*" } ] } } }, "createdDate": "2021-11-30T13:15:53.000Z", "lastUpdatedDate": "2022-12-15T22:46:33.000Z" }, "AmazonWorkSpacesWebReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesWebReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-11-30T14:20:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetTrustStoreCertificate", "workspaces-web:GetUserSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStoreCertificates", "workspaces-web:ListTrustStores", "workspaces-web:ListUserSettings" ], "Resource": "arn:aws:workspaces-web:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-02T20:20:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetTrustStoreCertificate", "workspaces-web:GetUserSettings", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStoreCertificates", "workspaces-web:ListTrustStores", "workspaces-web:ListUserSettings", "workspaces-web:ListUserAccessLoggingSettings" ], "Resource": "arn:aws:workspaces-web:*:*:*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "kinesis:ListStreams" ], "Resource": "*" } ] } } }, "createdDate": "2021-11-30T14:20:36.000Z", "lastUpdatedDate": "2022-11-02T20:20:44.000Z" }, "AWSIPAMServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIPAMServiceRolePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2021-11-30T19:08:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeIpv6Pools", "ec2:DescribePublicIpv4Pools", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IPAM" } } } ] } }, "v2": { "createdDate": "2023-01-25T20:13:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeIpv6Pools", "ec2:DescribePublicIpv4Pools", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:GetIpamDiscoveredResourceCidrs", "ec2:GetIpamDiscoveredAccounts", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IPAM" } } } ] } }, "v3": { "createdDate": "2021-11-30T19:08:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IPAMDiscoveryDescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeIpv6Pools", "ec2:DescribeNetworkInterfaces", "ec2:DescribePublicIpv4Pools", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetIpamDiscoveredAccounts", "ec2:GetIpamDiscoveredResourceCidrs", "globalaccelerator:ListAccelerators", "globalaccelerator:ListByoipCidrs", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "CloudWatchMetricsPublishActions", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IPAM" } } } ] } }, "v4": { "createdDate": "2021-11-30T19:08:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IPAMDiscoveryDescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeIpv6Pools", "ec2:DescribeNetworkInterfaces", "ec2:DescribePublicIpv4Pools", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetIpamDiscoveredAccounts", "ec2:GetIpamDiscoveredPublicAddresses", "ec2:GetIpamDiscoveredResourceCidrs", "globalaccelerator:ListAccelerators", "globalaccelerator:ListByoipCidrs", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "CloudWatchMetricsPublishActions", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IPAM" } } } ] } }, "v5": { "createdDate": "2021-11-30T19:08:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IPAMDiscoveryDescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeByoipCidrs", "ec2:DescribeIpv6Pools", "ec2:DescribeNetworkInterfaces", "ec2:DescribePublicIpv4Pools", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:GetIpamDiscoveredAccounts", "ec2:GetIpamDiscoveredPublicAddresses", "ec2:GetIpamDiscoveredResourceCidrs", "globalaccelerator:ListAccelerators", "globalaccelerator:ListByoipCidrs", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListChildren", "organizations:ListParents", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" }, { "Sid": "CloudWatchMetricsPublishActions", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/IPAM" } } } ] } } }, "createdDate": "2021-11-30T19:08:11.000Z", "lastUpdatedDate": "2024-11-08T16:29:09.000Z" }, "AWSPrivateNetworksServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSPrivateNetworksServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2021-12-16T23:17:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Private5G" } } } ] } } }, "createdDate": "2021-12-16T23:17:46.000Z", "lastUpdatedDate": "2021-12-16T23:17:46.000Z" }, "AmazonDevOpsGuruConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDevOpsGuruConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2021-12-17T18:43:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruFullAccess", "Effect": "Allow", "Action": [ "devops-guru:*" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "SnsListTopicsAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "SnsTopicOperations", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Publish" ], "Resource": "arn:aws:sns:*:*:DevOps-Guru-*" }, { "Sid": "DevOpsGuruSlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru", "Condition": { "StringLike": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "DevOpsGuruSlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "PerformanceInsightsMetricsDataAccess", "Effect": "Allow", "Action": [ "pi:GetResourceMetrics", "pi:DescribeDimensionKeys" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-08-25T18:18:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DevOpsGuruFullAccess", "Effect": "Allow", "Action": [ "devops-guru:*" ], "Resource": "*" }, { "Sid": "CloudFormationListStacksAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "CloudWatchGetMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "SnsListTopicsAccess", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "SnsTopicOperations", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Publish" ], "Resource": "arn:aws:sns:*:*:DevOps-Guru-*" }, { "Sid": "DevOpsGuruSlrCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru", "Condition": { "StringLike": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "DevOpsGuruSlrDeletion", "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" }, { "Sid": "RDSDescribeDBInstancesAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "PerformanceInsightsMetricsDataAccess", "Effect": "Allow", "Action": [ "pi:GetResourceMetrics", "pi:DescribeDimensionKeys" ], "Resource": "*" }, { "Sid": "CloudWatchLogsFilterLogEventsAccess", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:*", "Condition": { "StringEquals": { "aws:ResourceTag/DevOps-Guru-Analysis": "true" } } } ] } } }, "createdDate": "2021-12-17T18:43:09.000Z", "lastUpdatedDate": "2022-08-25T18:18:53.000Z" }, "EC2FastLaunchServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/EC2FastLaunchServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-01-10T13:08:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Fast Launch" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Fast Launch" } } }, { "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Fast Launch" } } }, { "Sid": "AllowCreateTaggedSnapshot", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Fast Launch" }, "StringLike": { "aws:RequestTag/CreatedByLaunchTemplateVersion": "*" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "CreatedByLaunchTemplateName", "CreatedByLaunchTemplateId" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateLaunchTemplate", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Fast Launch" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSnapshot", "RunInstances", "CreateLaunchTemplate" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Fast Launch" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/EC2" } } } ] } } }, "createdDate": "2022-01-10T13:08:21.000Z", "lastUpdatedDate": "2022-01-10T13:08:21.000Z" }, "AWSAppRunnerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppRunnerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-01-11T04:02:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner", "Condition": { "StringLike": { "iam:AWSServiceName": "apprunner.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "apprunner.amazonaws.com" } } }, { "Sid": "AppRunnerAdminAccess", "Effect": "Allow", "Action": "apprunner:*", "Resource": "*" } ] } } }, "createdDate": "2022-01-11T04:02:09.000Z", "lastUpdatedDate": "2022-01-11T04:02:09.000Z" }, "AppRunnerNetworkingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AppRunnerNetworkingServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-01-12T21:02:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AWSAppRunnerManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "StringLike": { "aws:RequestTag/AWSAppRunnerManaged": "*" } } }, { "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AWSAppRunnerManaged": "false" } } } ] } } }, "createdDate": "2022-01-12T21:02:40.000Z", "lastUpdatedDate": "2022-01-12T21:02:40.000Z" }, "AmazonInspector2ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonInspector2ReadOnlyAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2022-01-21T14:45:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "inspector2:ListAccountPermissions", "inspector2:ListMembers", "inspector2:ListFilters", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetMember", "inspector2:BatchGetFreeTrialInfo", "inspector2:ListUsageTotals", "inspector2:ListCoverageStatistics", "inspector2:BatchGetAccountStatus", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:ListCoverage", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-02T18:51:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "inspector2:ListAccountPermissions", "inspector2:ListMembers", "inspector2:ListFilters", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetMember", "inspector2:BatchGetFreeTrialInfo", "inspector2:ListUsageTotals", "inspector2:ListCoverageStatistics", "inspector2:BatchGetAccountStatus", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:ListCoverage", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListTagsForResource", "inspector2:BatchGetCodeSnippet", "inspector2:BatchGetMemberEc2DeepInspectionStatus", "inspector2:GetEc2DeepInspectionConfiguration", "codeguru-security:BatchGetFindings" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-05T21:54:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "inspector2:ListAccountPermissions", "inspector2:ListMembers", "inspector2:ListFilters", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetMember", "inspector2:BatchGetFreeTrialInfo", "inspector2:ListUsageTotals", "inspector2:ListCoverageStatistics", "inspector2:BatchGetAccountStatus", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:ListCoverage", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListTagsForResource", "inspector2:BatchGetCodeSnippet", "inspector2:BatchGetMemberEc2DeepInspectionStatus", "inspector2:GetEc2DeepInspectionConfiguration", "inspector2:SearchVulnerabilities", "codeguru-security:BatchGetFindings" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-06-23T20:12:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "inspector2:ListAccountPermissions", "inspector2:ListMembers", "inspector2:ListFilters", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetMember", "inspector2:BatchGetFreeTrialInfo", "inspector2:ListUsageTotals", "inspector2:ListCoverageStatistics", "inspector2:BatchGetAccountStatus", "inspector2:ListFindings", "inspector2:ListFindingAggregations", "inspector2:ListCoverage", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListTagsForResource", "inspector2:BatchGetCodeSnippet", "inspector2:BatchGetMemberEc2DeepInspectionStatus", "inspector2:GetEc2DeepInspectionConfiguration", "inspector2:SearchVulnerabilities", "inspector2:GetEncryptionKey", "inspector2:GetSbomExport", "codeguru-security:BatchGetFindings", "codeguru-security:GetAccountConfiguration" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2022-01-21T14:45:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization", "inspector2:BatchGet*", "inspector2:List*", "inspector2:Describe*", "inspector2:Get*", "inspector2:Search*", "codeguru-security:BatchGetFindings", "codeguru-security:GetAccountConfiguration" ], "Resource": "*" } ] } } }, "createdDate": "2022-01-21T14:45:14.000Z", "lastUpdatedDate": "2023-09-22T20:56:53.000Z" }, "AWSBackupServiceRolePolicyForS3Restore": { "arn": "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-02-18T17:39:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:PutBucketVersioning" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:DeleteObject", "s3:PutObjectVersionAcl", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObjectAcl", "s3:PutObjectAcl", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/*" ] }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-02-07T00:06:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:PutBucketVersioning", "s3:PutBucketOwnershipControls", "s3:GetBucketOwnershipControls" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:DeleteObject", "s3:PutObjectVersionAcl", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObjectAcl", "s3:PutObjectAcl", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/*" ] }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } } ] } } }, "createdDate": "2022-02-18T17:39:37.000Z", "lastUpdatedDate": "2023-02-07T00:06:00.000Z" }, "AWSBackupServiceRolePolicyForS3Backup": { "arn": "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-02-18T17:40:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:PutInventoryConfiguration" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectAcl", "s3:GetObject", "s3:GetObjectVersionTagging", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/*" }, { "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*" } ] } }, "v2": { "createdDate": "2022-02-26T00:01:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:PutInventoryConfiguration", "s3:GetBucketNotification", "s3:PutBucketNotification" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectAcl", "s3:GetObject", "s3:GetObjectVersionTagging", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/*" }, { "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*" } ] } }, "v3": { "createdDate": "2022-09-01T16:52:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:GetBucketAcl", "s3:PutInventoryConfiguration", "s3:GetBucketNotification", "s3:PutBucketNotification" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObjectAcl", "s3:GetObject", "s3:GetObjectVersionTagging", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/*" }, { "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*" } ] } }, "v4": { "createdDate": "2022-02-18T17:40:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchGetMetricDataPermissions", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" }, { "Sid": "EventBridgePermissionsForAwsBackupManagedRule", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:EnableRule", "events:PutRule", "events:RemoveTargets", "events:ListTargetsByRule", "events:DisableRule" ], "Resource": [ "arn:aws:events:*:*:rule/AwsBackupManagedRule*" ] }, { "Sid": "EventBridgeListRulesPermissions", "Effect": "Allow", "Action": "events:ListRules", "Resource": "*" }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "S3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:ListBucket", "s3:GetBucketVersioning", "s3:GetBucketLocation", "s3:GetBucketAcl", "s3:PutInventoryConfiguration", "s3:GetBucketNotification", "s3:PutBucketNotification" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "S3ObjectPermissions", "Effect": "Allow", "Action": [ "s3:GetObjectAcl", "s3:GetObject", "s3:GetObjectVersionTagging", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/*" }, { "Sid": "S3ListBucketPermissions", "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*" }, { "Sid": "RecoveryPointTaggingPermissions", "Effect": "Allow", "Action": [ "backup:TagResource" ], "Resource": "arn:aws:backup:*:*:recovery-point:*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2022-02-18T17:40:24.000Z", "lastUpdatedDate": "2024-05-17T17:12:03.000Z" }, "AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2022-08-26T19:13:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeletePartition", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetDatabase", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:SearchTables", "glue:UpdatePartition", "glue:UpdateTable", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:tableVersion/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/glue/*" } ] } }, "v1": { "createdDate": "2022-02-22T09:51:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeletePartition", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetDatabase", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:SearchTables", "glue:UpdatePartition", "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:tableVersion/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/glue/*" } ] } } }, "createdDate": "2022-02-22T09:51:13.000Z", "lastUpdatedDate": "2022-08-26T19:13:02.000Z" }, "AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-02-22T09:53:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sagemaker-*" }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole" ] }, { "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*", "arn:aws:codebuild:*:*:build/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" } ] } }, "v2": { "createdDate": "2022-02-22T09:53:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerCodePipelineCFnPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sagemaker-*" }, { "Sid": "AmazonSageMakerCodePipelineCFnTagPermission", "Effect": "Allow", "Action": [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/sagemaker-*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name" ] } } }, { "Sid": "AmazonSageMakerCodePipelineS3Permission", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodePipelinePassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole" ] }, { "Sid": "AmazonSageMakerCodePipelineCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*", "arn:aws:codebuild:*:*:build/sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodePipelineCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" }, { "Sid": "AmazonSageMakerCodePipelineCodeStarConnectionPermission", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } }, { "Sid": "AmazonSageMakerCodePipelineCodeConnectionPermission", "Effect": "Allow", "Action": [ "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } } ] } } }, "createdDate": "2022-02-22T09:53:17.000Z", "lastUpdatedDate": "2024-06-11T18:37:51.000Z" }, "AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-02-22T09:53:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "codepipeline:StartPipelineExecution", "Resource": "arn:aws:codepipeline:*:*:sagemaker-*" } ] } } }, "createdDate": "2022-02-22T09:53:59.000Z", "lastUpdatedDate": "2022-02-22T09:53:59.000Z" }, "AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-02-22T09:54:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" } ] } } }, "createdDate": "2022-02-22T09:54:35.000Z", "lastUpdatedDate": "2022-02-22T09:54:35.000Z" }, "AWSAppRunnerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppRunnerReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-02-24T21:24:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "apprunner:List*", "apprunner:Describe*" ], "Resource": "*" } ] } } }, "createdDate": "2022-02-24T21:24:15.000Z", "lastUpdatedDate": "2022-02-24T21:24:15.000Z" }, "AWSIdentitySyncFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIdentitySyncFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-03-23T23:29:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ds:AuthorizeApplication", "ds:UnauthorizeApplication" ], "Resource": "arn:*:ds:*:*:*/*" }, { "Effect": "Allow", "Action": [ "identity-sync:DeleteSyncProfile", "identity-sync:CreateSyncProfile", "identity-sync:GetSyncProfile", "identity-sync:StartSync", "identity-sync:StopSync", "identity-sync:CreateSyncFilter", "identity-sync:DeleteSyncFilter", "identity-sync:ListSyncFilters", "identity-sync:CreateSyncTarget", "identity-sync:DeleteSyncTarget", "identity-sync:GetSyncTarget", "identity-sync:UpdateSyncTarget" ], "Resource": "arn:*:identity-sync:*:*:*/*" } ] } } }, "createdDate": "2022-03-23T23:29:33.000Z", "lastUpdatedDate": "2022-03-23T23:29:33.000Z" }, "AWSIdentitySyncReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSIdentitySyncReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-03-23T23:29:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "identity-sync:GetSyncProfile", "identity-sync:ListSyncFilters", "identity-sync:GetSyncTarget" ], "Resource": "arn:*:identity-sync:*:*:*/*" } ] } } }, "createdDate": "2022-03-23T23:29:52.000Z", "lastUpdatedDate": "2022-03-23T23:29:52.000Z" }, "AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-03-25T04:25:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/apigateway/*" } ] } } }, "createdDate": "2022-03-25T04:25:36.000Z", "lastUpdatedDate": "2022-03-25T04:25:36.000Z" }, "AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-03-25T04:26:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] } ] } } }, "createdDate": "2022-03-25T04:26:40.000Z", "lastUpdatedDate": "2022-03-25T04:26:40.000Z" }, "AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-03-25T04:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeImageReplicationStatus", "ecr:DescribeRepositories", "ecr:DescribeImageReplicationStatus", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsEventsRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodePipelineRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com", "codepipeline.amazonaws.com", "cloudformation.amazonaws.com", "codebuild.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*" }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ] } ] } }, "v2": { "createdDate": "2022-03-25T04:27:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerCodeBuildCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" }, { "Sid": "AmazonSageMakerCodeBuildECRReadPermission", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeImageReplicationStatus", "ecr:DescribeRepositories", "ecr:DescribeImageReplicationStatus", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "*" ] }, { "Sid": "AmazonSageMakerCodeBuildECRWritePermission", "Effect": "Allow", "Action": [ "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodeBuildPassRoletPermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsEventsRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodePipelineRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com", "codepipeline.amazonaws.com", "cloudformation.amazonaws.com", "codebuild.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "AmazonSageMakerCodeBuildLogPermission", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*" }, { "Sid": "AmazonSageMakerCodeBuildS3Permission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodeBuildSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ] }, { "Sid": "AmazonSageMakerCodeBuildCodeStarConnectionPermission", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } }, { "Sid": "AmazonSageMakerCodeBuildCodeConnectionPermission", "Effect": "Allow", "Action": [ "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } } ] } } }, "createdDate": "2022-03-25T04:27:46.000Z", "lastUpdatedDate": "2024-06-11T18:45:27.000Z" }, "AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-04-04T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:DescribeImages", "ecr:BatchDeleteImage", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:algorithm/*", "arn:aws:sagemaker:*:*:app-image-config/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:automl-job/*", "arn:aws:sagemaker:*:*:code-repository/*", "arn:aws:sagemaker:*:*:compilation-job/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:data-quality-job-definition/*", "arn:aws:sagemaker:*:*:device-fleet/*/device/*", "arn:aws:sagemaker:*:*:device-fleet/*", "arn:aws:sagemaker:*:*:edge-packaging-job/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:experiment/*", "arn:aws:sagemaker:*:*:experiment-trial/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:feature-group/*", "arn:aws:sagemaker:*:*:human-loop/*", "arn:aws:sagemaker:*:*:human-task-ui/*", "arn:aws:sagemaker:*:*:hyper-parameter-tuning-job/*", "arn:aws:sagemaker:*:*:image/*", "arn:aws:sagemaker:*:*:image-version/*/*", "arn:aws:sagemaker:*:*:inference-recommendations-job/*", "arn:aws:sagemaker:*:*:labeling-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:model-bias-job-definition/*", "arn:aws:sagemaker:*:*:model-explainability-job-definition/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-quality-job-definition/*", "arn:aws:sagemaker:*:*:monitoring-schedule/*", "arn:aws:sagemaker:*:*:notebook-instance/*", "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:pipeline/*/execution/*", "arn:aws:sagemaker:*:*:processing-job/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:transform-job/*", "arn:aws:sagemaker:*:*:workforce/*", "arn:aws:sagemaker:*:*:workteam/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" } ] } }, "v2": { "createdDate": "2022-04-04T16:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerLambdaECRPermission", "Effect": "Allow", "Action": [ "ecr:DescribeImages", "ecr:BatchDeleteImage", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerLambdaEventBridgePermission", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid": "AmazonSageMakerLambdaS3BucketPermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerLambdaS3ObjectPermission", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerLambdaSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:algorithm/*", "arn:aws:sagemaker:*:*:app-image-config/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:automl-job/*", "arn:aws:sagemaker:*:*:code-repository/*", "arn:aws:sagemaker:*:*:compilation-job/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:data-quality-job-definition/*", "arn:aws:sagemaker:*:*:device-fleet/*/device/*", "arn:aws:sagemaker:*:*:device-fleet/*", "arn:aws:sagemaker:*:*:edge-packaging-job/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:experiment/*", "arn:aws:sagemaker:*:*:experiment-trial/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:feature-group/*", "arn:aws:sagemaker:*:*:human-loop/*", "arn:aws:sagemaker:*:*:human-task-ui/*", "arn:aws:sagemaker:*:*:hyper-parameter-tuning-job/*", "arn:aws:sagemaker:*:*:image/*", "arn:aws:sagemaker:*:*:image-version/*/*", "arn:aws:sagemaker:*:*:inference-recommendations-job/*", "arn:aws:sagemaker:*:*:labeling-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:model-bias-job-definition/*", "arn:aws:sagemaker:*:*:model-explainability-job-definition/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-quality-job-definition/*", "arn:aws:sagemaker:*:*:monitoring-schedule/*", "arn:aws:sagemaker:*:*:notebook-instance/*", "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:pipeline/*/execution/*", "arn:aws:sagemaker:*:*:processing-job/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:transform-job/*", "arn:aws:sagemaker:*:*:workforce/*", "arn:aws:sagemaker:*:*:workteam/*" ] }, { "Sid": "AmazonSageMakerLambdaPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] }, { "Sid": "AmazonSageMakerLambdaLogPermission", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" }, { "Sid": "AmazonSageMakerLambdaCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:StartBuild", "codebuild:BatchGetBuilds" ], "Resource": "arn:aws:codebuild:*:*:project/sagemaker-*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:project-name": "*" } } } ] } } }, "createdDate": "2022-04-04T16:34:43.000Z", "lastUpdatedDate": "2024-06-11T18:57:13.000Z" }, "AmazonEBSCSIDriverPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-04T17:24:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:AttachVolume", "ec2:DetachVolume", "ec2:ModifyVolume", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/kubernetes.io/cluster/*": "owned" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/kubernetes.io/cluster/*": "owned" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeSnapshotName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } } ] } }, "v2": { "createdDate": "2022-11-18T14:42:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:AttachVolume", "ec2:DetachVolume", "ec2:ModifyVolume", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeSnapshotName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } } ] } }, "v3": { "createdDate": "2022-04-04T17:24:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:ModifyVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume", "ec2:EnableFastSnapshotRestores" ], "Resource": "arn:aws:ec2:*:*:snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "aws:RequestTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringLike": { "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/CSIVolumeSnapshotName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:RequestTag/ebs.csi.aws.com/cluster": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/CSIVolumeSnapshotName": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true" } } } ] } } }, "createdDate": "2022-04-04T17:24:29.000Z", "lastUpdatedDate": "2025-01-13T17:07:06.000Z" }, "AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-04T22:02:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "chime:GetMeeting", "chime:CreateAttendee", "chime:DeleteAttendee" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-04-04T22:02:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeMediaPipelines-*" ] }, { "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "chime:GetMeeting", "chime:CreateAttendee", "chime:DeleteAttendee" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-04-04T22:02:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPutMetricsForChimeSDKNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/ChimeSDK" } } }, { "Sid": "AllowKinesisVideoStreamsAccess", "Effect": "Allow", "Action": [ "kinesisvideo:GetDataEndpoint", "kinesisvideo:PutMedia", "kinesisvideo:UpdateDataRetention", "kinesisvideo:DescribeStream", "kinesisvideo:CreateStream" ], "Resource": [ "arn:aws:kinesisvideo:*:*:stream/ChimeMediaPipelines-*" ] }, { "Sid": "AllowKinesisVideoStreamsListAccess", "Effect": "Allow", "Action": [ "kinesisvideo:ListStreams" ], "Resource": [ "*" ] }, { "Sid": "AllowChimeMeetingAccess", "Effect": "Allow", "Action": [ "chime:GetMeeting", "chime:CreateAttendee", "chime:DeleteAttendee" ], "Resource": "*" } ] } } }, "createdDate": "2022-04-04T22:02:05.000Z", "lastUpdatedDate": "2023-12-08T19:14:31.000Z" }, "AmazonRDSPerformanceInsightsReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-05T00:02:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Effect": "Allow", "Action": "rds:DescribeDBClusters", "Resource": "*" }, { "Effect": "Allow", "Action": "pi:DescribeDimensionKeys", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetDimensionKeyDetails", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetResourceMetadata", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:ListAvailableResourceDimensions", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:ListAvailableResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" } ] } }, "v2": { "createdDate": "2022-04-05T00:02:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Effect": "Allow", "Action": "rds:DescribeDBClusters", "Resource": "*" }, { "Effect": "Allow", "Action": "pi:DescribeDimensionKeys", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetDimensionKeyDetails", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetResourceMetadata", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:ListAvailableResourceDimensions", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:ListAvailableResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": "pi:GetPerformanceAnalysisReport", "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Effect": "Allow", "Action": "pi:ListPerformanceAnalysisReports", "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Effect": "Allow", "Action": "pi:ListTagsForResource", "Resource": "arn:aws:pi:*:*:*/rds/*" } ] } }, "v3": { "createdDate": "2022-04-05T00:02:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRDSDescribeDBInstances", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AmazonRDSDescribeDBClusters", "Effect": "Allow", "Action": "rds:DescribeDBClusters", "Resource": "*" }, { "Sid": "AmazonRDSPerformanceInsightsDescribeDimensionKeys", "Effect": "Allow", "Action": "pi:DescribeDimensionKeys", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsGetDimensionKeyDetails", "Effect": "Allow", "Action": "pi:GetDimensionKeyDetails", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsGetResourceMetadata", "Effect": "Allow", "Action": "pi:GetResourceMetadata", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsGetResourceMetrics", "Effect": "Allow", "Action": "pi:GetResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsListAvailableResourceDimensions", "Effect": "Allow", "Action": "pi:ListAvailableResourceDimensions", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsListAvailableResourceMetrics", "Effect": "Allow", "Action": "pi:ListAvailableResourceMetrics", "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsGetPerformanceAnalysisReport", "Effect": "Allow", "Action": "pi:GetPerformanceAnalysisReport", "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Sid": "AmazonRDSPerformanceInsightsListPerformanceAnalysisReports", "Effect": "Allow", "Action": "pi:ListPerformanceAnalysisReports", "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Sid": "AmazonRDSPerformanceInsightsListTagsForResource", "Effect": "Allow", "Action": "pi:ListTagsForResource", "Resource": "arn:aws:pi:*:*:*/rds/*" } ] } } }, "createdDate": "2022-04-05T00:02:08.000Z", "lastUpdatedDate": "2023-10-23T21:17:06.000Z" }, "ROSAManageSubscription": { "arn": "arn:aws:iam::aws:policy/ROSAManageSubscription", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-04-11T20:58:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:ProductId": [ "34850061-abaf-402d-92df-94325c9e947f" ] } } }, { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-08-04T19:59:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:ProductId": [ "34850061-abaf-402d-92df-94325c9e947f", "bfdca560-2c78-4e64-8193-794c159e6d30" ] } } }, { "Effect": "Allow", "Action": [ "aws-marketplace:ViewSubscriptions" ], "Resource": "*" } ] } } }, "createdDate": "2022-04-11T20:58:08.000Z", "lastUpdatedDate": "2023-08-04T19:59:14.000Z" }, "AWSBillingConductorFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSBillingConductorFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-04-13T18:02:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "billingconductor:*", "organizations:ListAccounts", "pricing:DescribeServices" ], "Resource": "*" } ] } } }, "createdDate": "2022-04-13T18:02:29.000Z", "lastUpdatedDate": "2022-04-13T18:02:29.000Z" }, "AWSBillingConductorReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSBillingConductorReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-04-13T18:02:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "billingconductor:List*", "organizations:ListAccounts", "pricing:DescribeServices" ], "Resource": "*" } ] } } }, "createdDate": "2022-04-13T18:02:59.000Z", "lastUpdatedDate": "2022-04-13T18:02:59.000Z" }, "AwsGlueSessionUserRestrictedServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AwsGlueSessionUserRestrictedServiceRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-14T21:30:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "glue:*", "Resource": [ "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:tableVersion/*", "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:userDefinedFunction/*", "arn:aws:glue:*:*:devEndpoint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:trigger/*", "arn:aws:glue:*:*:crawler/*", "arn:aws:glue:*:*:workflow/*", "arn:aws:glue:*:*:mlTransform/*", "arn:aws:glue:*:*:registry/*", "arn:aws:glue:*:*:schema/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v2": { "createdDate": "2022-04-14T21:30:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": "glue:*", "Resource": [ "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:tableVersion/*", "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:userDefinedFunction/*", "arn:aws:glue:*:*:devEndpoint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:trigger/*", "arn:aws:glue:*:*:crawler/*", "arn:aws:glue:*:*:workflow/*", "arn:aws:glue:*:*:mlTransform/*", "arn:aws:glue:*:*:registry/*", "arn:aws:glue:*:*:schema/*" ] }, { "Sid": "AllowCompletionActions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "AllowSessionActions", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowStatementActions", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Sid": "AllowListSessionsAction", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "DenyTagActions", "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Sid": "AllowS3ObjectCrawlerActions", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*" ] }, { "Sid": "AllowLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Sid": "AllowTagsActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v3": { "createdDate": "2022-04-14T21:30:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": "glue:*", "Resource": [ "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:tableVersion/*", "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:userDefinedFunction/*", "arn:aws:glue:*:*:devEndpoint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:trigger/*", "arn:aws:glue:*:*:crawler/*", "arn:aws:glue:*:*:workflow/*", "arn:aws:glue:*:*:mlTransform/*", "arn:aws:glue:*:*:registry/*", "arn:aws:glue:*:*:schema/*" ] }, { "Sid": "AllowCompletionActions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "AllowSessionActions", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowGlueTaggingAction", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "arn:aws:glue:*:*:session/*", "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}", "aws:RequestTag/owner": "${aws:userid}" } } }, { "Sid": "AllowStatementActions", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Sid": "AllowListSessionsAction", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "DenyTagActions", "Effect": "Deny", "Action": [ "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Sid": "AllowS3ObjectCrawlerActions", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*" ] }, { "Sid": "AllowLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Sid": "AllowTagsActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2022-04-14T21:30:07.000Z", "lastUpdatedDate": "2024-08-05T23:14:07.000Z" }, "AwsGlueSessionUserRestrictedPolicy": { "arn": "arn:aws:iam::aws:policy/AwsGlueSessionUserRestrictedPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-14T21:31:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestricted*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2022-04-14T21:31:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSessionActions", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowCompletionActions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Sid": "AllowListSessions", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "DenyTagActions", "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowPassRoleActions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestricted*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2022-04-14T21:31:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSessionActions", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:userid}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowGlueTaggingAction", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "arn:aws:glue:*:*:session/*", "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}", "aws:RequestTag/owner": "${aws:userid}" } } }, { "Sid": "AllowCompletionActions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:userid}" } } }, { "Sid": "AllowListSessions", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "DenyTagActions", "Effect": "Deny", "Action": [ "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowPassRoleActions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestricted*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-04-14T21:31:01.000Z", "lastUpdatedDate": "2024-08-05T23:06:45.000Z" }, "AwsGlueSessionUserRestrictedNotebookPolicy": { "arn": "arn:aws:iam::aws:policy/AwsGlueSessionUserRestrictedNotebookPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-04-18T15:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestrictedForNotebook*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2022-04-18T15:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "NotebokAllowActions0", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "NotebookAllowActions1", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "NotebookAllowActions2", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Sid": "NotebookAllowActions3", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "NotebookDenyActions", "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "NotebookPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestrictedForNotebook*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2022-04-18T15:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "NotebokAllowActions0", "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowGlueTaggingAction", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "arn:aws:glue:*:*:session/*", "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}", "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Sid": "NotebookAllowActions1", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": [ "arn:aws:glue:*:*:completion/*" ] }, { "Sid": "NotebookAllowActions2", "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Sid": "NotebookAllowActions3", "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Sid": "NotebookDenyActions", "Effect": "Deny", "Action": [ "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "NotebookPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AwsGlueSessionServiceRoleUserRestrictedForNotebook*", "arn:aws:iam::*:role/AwsGlueSessionUserRestrictedNotebookServiceRole*" ], "Condition": { "StringLike": { "iam:PassedToService": [ "glue.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-04-18T15:24:56.000Z", "lastUpdatedDate": "2024-08-15T20:51:03.000Z" }, "AwsGlueSessionUserRestrictedNotebookServiceRole": { "arn": "arn:aws:iam::aws:policy/service-role/AwsGlueSessionUserRestrictedNotebookServiceRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-04-18T15:27:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "glue:*", "Resource": [ "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:tableVersion/*", "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:userDefinedFunction/*", "arn:aws:glue:*:*:devEndpoint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:trigger/*", "arn:aws:glue:*:*:crawler/*", "arn:aws:glue:*:*:workflow/*", "arn:aws:glue:*:*:mlTransform/*", "arn:aws:glue:*:*:registry/*", "arn:aws:glue:*:*:schema/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "glue:TagResource", "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v2": { "createdDate": "2022-04-18T15:27:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "glue:*", "Resource": [ "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:tableVersion/*", "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:userDefinedFunction/*", "arn:aws:glue:*:*:devEndpoint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:trigger/*", "arn:aws:glue:*:*:crawler/*", "arn:aws:glue:*:*:workflow/*", "arn:aws:glue:*:*:mlTransform/*", "arn:aws:glue:*:*:registry/*", "arn:aws:glue:*:*:schema/*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Sid": "AllowGlueTaggingAction", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "arn:aws:glue:*:*:session/*", "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}", "aws:RequestTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Effect": "Allow", "Action": [ "glue:RunStatement", "glue:GetStatement", "glue:ListStatements", "glue:CancelStatement", "glue:StopSession", "glue:DeleteSession", "glue:GetSession" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}" } } }, { "Effect": "Allow", "Action": [ "glue:ListSessions" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "glue:UntagResource", "tag:TagResources", "tag:UntagResources" ], "Resource": [ "arn:aws:glue:*:*:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "owner" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::aws-glue-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*/*", "arn:aws:s3:::*/*aws-glue-*/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::crawler-public*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:/aws-glue/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } }, "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2022-04-18T15:27:11.000Z", "lastUpdatedDate": "2024-08-15T20:51:58.000Z" }, "AWSMigrationHubOrchestratorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubOrchestratorServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-04-20T02:24:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "launchwizard:ListProvisionedApps", "launchwizard:DescribeProvisionedApp" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "mgn.amazonaws.com" } } }, { "Action": [ "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:CancelCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:s3:::aws-migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:DeleteRule", "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*" }, { "Effect": "Allow", "Action": [ "mgn:GetReplicationConfiguration", "mgn:GetLaunchConfiguration", "mgn:StartCutover", "mgn:FinalizeCutover", "mgn:StartTest", "mgn:UpdateReplicationConfiguration", "mgn:DescribeSourceServers", "mgn:MarkAsArchived", "mgn:ChangeServerLifeCycleState" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-12-21T18:48:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "launchwizard:ListProvisionedApps", "launchwizard:DescribeProvisionedApp" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "mgn.amazonaws.com" } } }, { "Action": [ "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:CancelCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:s3:::aws-migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:DeleteRule", "events:PutRule", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*" }, { "Effect": "Allow", "Action": [ "mgn:GetReplicationConfiguration", "mgn:GetLaunchConfiguration", "mgn:StartCutover", "mgn:FinalizeCutover", "mgn:StartTest", "mgn:UpdateReplicationConfiguration", "mgn:DescribeSourceServers", "mgn:MarkAsArchived", "mgn:ChangeServerLifeCycleState" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeImportImageTasks" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "migrationhub-orchestrator-vmie-*" } } } ] } }, "v3": { "createdDate": "2023-02-24T20:28:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "launchwizard:ListProvisionedApps", "launchwizard:DescribeProvisionedApp" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "mgn.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ec2:DescribeLaunchTemplates" ], "Resource": "*" }, { "Action": [ "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:CancelCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:s3:::aws-migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:DeleteRule", "events:PutRule", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*" }, { "Effect": "Allow", "Action": [ "mgn:GetReplicationConfiguration", "mgn:GetLaunchConfiguration", "mgn:StartCutover", "mgn:FinalizeCutover", "mgn:StartTest", "mgn:UpdateReplicationConfiguration", "mgn:DescribeSourceServers", "mgn:MarkAsArchived", "mgn:ChangeServerLifeCycleState" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeImportImageTasks" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "migrationhub-orchestrator-vmie-*" } } } ] } }, "v4": { "createdDate": "2022-04-20T02:24:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ApplicationDiscoveryService", "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource": "*" }, { "Sid": "LaunchWizard", "Effect": "Allow", "Action": [ "launchwizard:ListProvisionedApps", "launchwizard:DescribeProvisionedApp", "launchwizard:ListDeployments", "launchwizard:GetDeployment" ], "Resource": "*" }, { "Sid": "EC2instances", "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "ec2MGNLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "mgn.amazonaws.com" } } }, { "Sid": "ec2LaunchTemplates", "Effect": "Allow", "Action": [ "ec2:DescribeLaunchTemplates" ], "Resource": "*" }, { "Sid": "getHomeRegion", "Action": [ "mgh:GetHomeRegion" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "SSMcommand", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:CancelCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:s3:::aws-migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*" ] }, { "Sid": "SSM", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource": [ "*" ] }, { "Sid": "s3GetObject", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Sid": "EventBridge", "Effect": "Allow", "Action": [ "events:PutTargets", "events:DescribeRule", "events:DeleteRule", "events:PutRule", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*" }, { "Sid": "MGN", "Effect": "Allow", "Action": [ "mgn:GetReplicationConfiguration", "mgn:GetLaunchConfiguration", "mgn:StartCutover", "mgn:FinalizeCutover", "mgn:StartTest", "mgn:UpdateReplicationConfiguration", "mgn:DescribeSourceServers", "mgn:MarkAsArchived", "mgn:ChangeServerLifeCycleState" ], "Resource": "*" }, { "Sid": "ec2DescribeImportImage", "Effect": "Allow", "Action": [ "ec2:DescribeImportImageTasks" ], "Resource": "*" }, { "Sid": "s3ListBucket", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "migrationhub-orchestrator-vmie-*" } } } ] } } }, "createdDate": "2022-04-20T02:24:04.000Z", "lastUpdatedDate": "2024-03-04T18:25:12.000Z" }, "AWSMigrationHubOrchestratorPlugin": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubOrchestratorPlugin", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-04-20T02:25:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::migrationhub-orchestrator-*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "execute-api:Invoke", "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:*:*:*/prod/*/put-log-data", "arn:aws:execute-api:*:*:*/prod/*/put-metric-data" ] }, { "Effect": "Allow", "Action": [ "migrationhub-orchestrator:RegisterPlugin", "migrationhub-orchestrator:GetMessage", "migrationhub-orchestrator:SendMessage" ], "Resource": "arn:aws:migrationhub-orchestrator:*:*:*" }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-orchestrator-*" } ] } } }, "createdDate": "2022-04-20T02:25:10.000Z", "lastUpdatedDate": "2022-04-20T02:25:10.000Z" }, "AWSMigrationHubOrchestratorConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubOrchestratorConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-04-20T02:26:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "migrationhub-orchestrator:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations", "discovery:GetDiscoverySummary" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:GetHomeRegion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "migrationhub-orchestrator.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/migrationhub-orchestrator.amazonaws.com/AWSServiceRoleForMigrationHubOrchestrator*" } ] } }, "v2": { "createdDate": "2022-04-20T02:26:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MHO", "Effect": "Allow", "Action": [ "migrationhub-orchestrator:*" ], "Resource": "*" }, { "Sid": "ListAllMyBuckets", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "S3MHO", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Sid": "ListSecrets", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "Configuration", "Effect": "Allow", "Action": [ "discovery:DescribeConfigurations", "discovery:ListConfigurations", "discovery:GetDiscoverySummary" ], "Resource": "*" }, { "Sid": "GetHomeRegion", "Effect": "Allow", "Action": [ "mgh:GetHomeRegion" ], "Resource": "*" }, { "Sid": "EC2Describe", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "KMS", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "IAMListProfileRole", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ECS", "Effect": "Allow", "Action": [ "ecs:ListClusters" ], "Resource": "*" }, { "Sid": "Account", "Effect": "Allow", "Action": [ "account:ListRegions" ], "Resource": "*" }, { "Sid": "CreateServiceRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "migrationhub-orchestrator.amazonaws.com" } } }, { "Sid": "GetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/migrationhub-orchestrator.amazonaws.com/AWSServiceRoleForMigrationHubOrchestrator*" } ] } } }, "createdDate": "2022-04-20T02:26:28.000Z", "lastUpdatedDate": "2023-12-05T17:34:16.000Z" }, "AWSMigrationHubOrchestratorInstanceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubOrchestratorInstanceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-04-20T02:43:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:migrationhub-orchestrator-*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::aws-migrationhub-orchestrator-*/*" ] } ] } } }, "createdDate": "2022-04-20T02:43:50.000Z", "lastUpdatedDate": "2022-04-20T02:43:50.000Z" }, "MonitronServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/MonitronServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-05-02T19:22:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/monitron/*" ] } ] } } }, "createdDate": "2022-05-02T19:22:03.000Z", "lastUpdatedDate": "2022-05-02T19:22:03.000Z" }, "AmazonEMRServerlessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRServerlessServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v2": { "createdDate": "2023-04-20T15:47:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/EMRServerless", "AWS/Usage" ] } } } ] } }, "v1": { "createdDate": "2022-05-20T23:15:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/EMRServerless" } } } ] } }, "v3": { "createdDate": "2022-05-20T23:15:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2PolicyStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Sid": "CloudWatchPolicyStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/EMRServerless", "AWS/Usage" ] } } } ] } } }, "createdDate": "2022-05-20T23:15:42.000Z", "lastUpdatedDate": "2024-01-25T18:21:43.000Z" }, "AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM": { "arn": "arn:aws:iam::aws:policy/AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-05-25T19:03:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus", "ec2:StartInstances", "ec2:StopInstances", "rds:DescribeDBInstances", "rds:StartDBInstance", "rds:StopDBInstance" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ssm.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-StartEC2Instance:*", "arn:aws:ssm:*:*:automation-definition/AWS-StopEC2Instance:*", "arn:aws:ssm:*:*:automation-definition/AWS-StartRdsInstance:*", "arn:aws:ssm:*:*:automation-definition/AWS-StopRdsInstance:*" ] } ] } } }, "createdDate": "2022-05-25T19:03:30.000Z", "lastUpdatedDate": "2022-05-25T19:03:30.000Z" }, "AWSElasticDisasterRecoveryStagingAccountPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryStagingAccountPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-05-26T09:49:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers", "drs:DescribeRecoverySnapshots", "drs:CreateConvertedSnapshotForDrs", "drs:GetReplicationConfiguration", "drs:DescribeJobs", "drs:DescribeJobLogItems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/userId": "${aws:SourceIdentity}" }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v2": { "createdDate": "2022-05-26T09:49:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSStagingAccountPolicy1", "Effect": "Allow", "Action": [ "drs:DescribeSourceServers", "drs:DescribeRecoverySnapshots", "drs:CreateConvertedSnapshotForDrs", "drs:GetReplicationConfiguration", "drs:DescribeJobs", "drs:DescribeJobLogItems" ], "Resource": "*" }, { "Sid": "DRSStagingAccountPolicy2", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/userId": "${aws:SourceIdentity}" }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } } }, "createdDate": "2022-05-26T09:49:18.000Z", "lastUpdatedDate": "2023-11-27T13:07:49.000Z" }, "AWSElasticDisasterRecoveryEc2InstancePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryEc2InstancePolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2022-05-26T12:30:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" } ] } }, "v2": { "createdDate": "2023-05-14T07:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } }, "v3": { "createdDate": "2023-06-13T16:30:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } }, "v4": { "createdDate": "2022-05-26T12:30:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } }, "v5": { "createdDate": "2022-05-26T12:30:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSEc2InstancePolicy1", "Effect": "Allow", "Action": [ "drs:GetAgentInstallationAssetsForDrs", "drs:SendClientLogsForDrs", "drs:SendClientMetricsForDrs", "drs:CreateSourceServerForDrs", "drs:CreateSourceNetwork" ], "Resource": "*" }, { "Sid": "DRSEc2InstancePolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } }, { "Sid": "DRSEc2InstancePolicy3", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-network/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceNetwork" } } }, { "Sid": "DRSEc2InstancePolicy4", "Effect": "Allow", "Action": [ "drs:SendAgentMetricsForDrs", "drs:SendAgentLogsForDrs", "drs:UpdateAgentSourcePropertiesForDrs", "drs:UpdateAgentReplicationInfoForDrs", "drs:UpdateAgentConversionInfoForDrs", "drs:GetAgentCommandForDrs", "drs:GetAgentConfirmedResumeInfoForDrs", "drs:GetAgentRuntimeConfigurationForDrs", "drs:UpdateAgentBacklogForDrs", "drs:GetAgentReplicationInfoForDrs" ], "Resource": "arn:aws:drs:*:*:source-server/*" }, { "Sid": "DRSEc2InstancePolicy5", "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": [ "arn:aws:iam::*:role/service-role/DRSCrossAccountAgentAuthorizedRole_*" ], "Condition": { "StringLike": { "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}" }, "ForAnyValue:StringEquals": { "sts:TransitiveTagKeys": "SourceInstanceARN" } } } ] } } }, "createdDate": "2022-05-26T12:30:18.000Z", "lastUpdatedDate": "2023-11-27T13:39:44.000Z" }, "AWSApplicationMigrationAgentPolicy_v2": { "arn": "arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationAgentPolicy_v2", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-06-06T14:14:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn", "mgn:IssueClientCertificateForMgn" ], "Resource": "arn:aws:mgn:*:*:source-server/${aws:SourceIdentity}" } ] } } }, "createdDate": "2022-06-06T14:14:38.000Z", "lastUpdatedDate": "2022-06-06T14:14:38.000Z" }, "AWSM2ServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSM2ServicePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-06-07T20:26:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterfacePermission", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/M2" ] } } } ] } } }, "createdDate": "2022-06-07T20:26:39.000Z", "lastUpdatedDate": "2022-06-07T20:26:39.000Z" }, "AWSManagedServicesDeploymentToolkitPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSManagedServicesDeploymentToolkitPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-06-09T18:33:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketPolicy", "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject*", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketLogging", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutEncryptionConfiguration" ], "Resource": "arn:aws:s3:::ams-cdktoolkit*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplateSummary", "cloudformation:UpdateTermination*" ], "Resource": "arn:aws:cloudformation:*:*:stack/ams-cdk-toolkit*" } ] } }, "v2": { "createdDate": "2023-01-30T22:10:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject*", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketLogging", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::ams-cdktoolkit*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplateSummary", "cloudformation:UpdateTermination*" ], "Resource": "arn:aws:cloudformation:*:*:stack/ams-cdk-toolkit*" } ] } }, "v3": { "createdDate": "2023-05-10T17:48:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectAttributes", "s3:GetObjectLegalHold", "s3:GetObjectRetention", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionAttributes", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionTagging", "s3:GetObjectVersionTorrent", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketLogging", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::ams-cdktoolkit*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:GetTemplateSummary", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateTerminationProtection" ], "Resource": "arn:aws:cloudformation:*:*:stack/ams-cdk-toolkit*" }, { "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteLifecyclePolicy", "ecr:DeleteRepository", "ecr:DeleteRepositoryPolicy", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:ListTagsForResource", "ecr:PutImageTagMutability", "ecr:PutLifecyclePolicy", "ecr:SetRepositoryPolicy", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:aws:ecr:*:*:repository/ams-cdktoolkit*" } ] } }, "v4": { "createdDate": "2022-06-09T18:33:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AMSCDKToolkitS3Permissions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject", "s3:DeleteObjectTagging", "s3:DeleteObjectVersion", "s3:DeleteObjectVersionTagging", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketPolicy", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectAttributes", "s3:GetObjectLegalHold", "s3:GetObjectRetention", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionAttributes", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionTagging", "s3:GetObjectVersionTorrent", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutBucketAcl", "s3:PutBucketLogging", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::ams-cdktoolkit*" }, { "Sid": "AMSCDKToolkitCloudFormationPermissions", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplate", "cloudformation:GetTemplateSummary", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateTerminationProtection" ], "Resource": "arn:aws:cloudformation:*:*:stack/ams-cdk-toolkit*" }, { "Sid": "AMSCDKToolkitECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetRepositoryScanningConfiguration", "ecr:CreateRepository", "ecr:DeleteLifecyclePolicy", "ecr:DeleteRepository", "ecr:DeleteRepositoryPolicy", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:ListTagsForResource", "ecr:PutImageScanningConfiguration", "ecr:PutImageTagMutability", "ecr:PutLifecyclePolicy", "ecr:SetRepositoryPolicy", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:aws:ecr:*:*:repository/ams-cdktoolkit*" } ] } } }, "createdDate": "2022-06-09T18:33:03.000Z", "lastUpdatedDate": "2024-04-04T20:41:54.000Z" }, "AWSCloudTrail_ReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCloudTrail_ReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-06-14T17:19:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:Get*", "cloudtrail:Describe*", "cloudtrail:List*", "cloudtrail:LookupEvents" ], "Resource": "*" } ] } } }, "createdDate": "2022-06-14T17:19:05.000Z", "lastUpdatedDate": "2022-06-14T17:19:05.000Z" }, "AWSApplicationMigrationAgentInstallationPolicy": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationAgentInstallationPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-06-19T07:51:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:GetAgentInstallationAssetsForMgn", "mgn:SendClientLogsForMgn", "mgn:RegisterAgentForMgn", "mgn:VerifyClientRoleForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:IssueClientCertificateForMgn" ], "Resource": "arn:aws:mgn:*:*:source-server/*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*", "Condition": { "StringEquals": { "mgn:CreateAction": "RegisterAgentForMgn" } } } ] } }, "v2": { "createdDate": "2022-09-20T11:21:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:GetAgentInstallationAssetsForMgn", "mgn:SendClientMetricsForMgn", "mgn:SendClientLogsForMgn", "mgn:RegisterAgentForMgn", "mgn:VerifyClientRoleForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:IssueClientCertificateForMgn" ], "Resource": "arn:aws:mgn:*:*:source-server/*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*", "Condition": { "StringEquals": { "mgn:CreateAction": "RegisterAgentForMgn" } } } ] } } }, "createdDate": "2022-06-19T07:51:04.000Z", "lastUpdatedDate": "2022-09-20T11:21:24.000Z" }, "AWSWellArchitectedOrganizationsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSWellArchitectedOrganizationsServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2022-07-25T18:03:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListChildren", "organizations:ListParents", "organizations:ListRoots" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2022-06-23T17:15:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListChildren", "organizations:ListParents", "organizations:ListRoots" ], "Resource": "*" } ] } } }, "createdDate": "2022-06-23T17:15:26.000Z", "lastUpdatedDate": "2022-07-25T18:03:31.000Z" }, "AWSRolesAnywhereServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSRolesAnywhereServicePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-07-05T15:26:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/RolesAnywhere", "AWS/Usage" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "arn:aws:acm-pca:*:*:*" } ] } } }, "createdDate": "2022-07-05T15:26:11.000Z", "lastUpdatedDate": "2022-07-05T15:26:11.000Z" }, "AWSNetworkManagerCloudWANServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkManagerCloudWANServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-07-12T12:17:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTransitGatewayRouteTableAnnouncement", "ec2:DeleteTransitGatewayRouteTableAnnouncement", "ec2:EnableTransitGatewayRouteTablePropagation", "ec2:DisableTransitGatewayRouteTablePropagation" ], "Resource": "*" } ] } } }, "createdDate": "2022-07-12T12:17:49.000Z", "lastUpdatedDate": "2022-07-12T12:17:49.000Z" }, "AmazonGuardDutyMalwareProtectionServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyMalwareProtectionServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-07-19T19:06:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTasks", "ecs:DescribeTasks", "eks:DescribeCluster" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyScanId" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:*/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/GuardDutyScanId": "*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "GuardDutyExcluded", "GuardDutyFindingDetected" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/GuardDutyScanId": "*" }, "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Effect": "Deny", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/group": "all" } } }, { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" }, "StringLike": { "kms:EncryptionContext:aws:ebs:id": "snap-*" }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "Decrypt", "CreateGrant", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "RetireGrant", "DescribeKey" ] }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/guardduty/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/guardduty/*:log-stream:*" } ] } }, "v2": { "createdDate": "2022-07-19T19:06:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeAndListPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTasks", "ecs:DescribeTasks", "eks:DescribeCluster" ], "Resource": "*" }, { "Sid": "CreateSnapshotVolumeConditionalStatement", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Sid": "CreateSnapshotConditionalStatement", "Effect": "Allow", "Action": "ec2:CreateSnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyScanId" } } }, { "Sid": "CreateTagsPermission", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:*/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSnapshot" } } }, { "Sid": "AddTagsToSnapshotPermission", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/GuardDutyScanId": "*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "GuardDutyExcluded", "GuardDutyFindingDetected" ] } } }, { "Sid": "DeleteAndShareSnapshotPermission", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot", "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/GuardDutyScanId": "*" }, "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Sid": "PreventPublicAccessToSnapshotPermission", "Effect": "Deny", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/group": "all" } } }, { "Sid": "CreateGrantPermission", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" }, "StringLike": { "kms:EncryptionContext:aws:ebs:id": "snap-*" }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "Decrypt", "CreateGrant", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "RetireGrant", "DescribeKey" ] }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "ShareSnapshotKMSPermission", "Effect": "Allow", "Action": [ "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } }, { "Sid": "DescribeKeyPermission", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "GuardDutyLogGroupPermission", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/guardduty/*" }, { "Sid": "GuardDutyLogStreamPermission", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/guardduty/*:log-stream:*" }, { "Sid": "EBSDirectAPIPermissions", "Effect": "Allow", "Action": [ "ebs:GetSnapshotBlock", "ebs:ListSnapshotBlocks" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/GuardDutyScanId": "*" }, "Null": { "aws:ResourceTag/GuardDutyExcluded": "true" } } } ] } } }, "createdDate": "2022-07-19T19:06:53.000Z", "lastUpdatedDate": "2024-01-25T22:24:00.000Z" }, "AWSVendorInsightsVendorFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSVendorInsightsVendorFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-07-26T15:05:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aws-marketplace:DescribeEntity", "Resource": "arn:aws:aws-marketplace:*:*:*/SaaSProduct/*" }, { "Effect": "Allow", "Action": "aws-marketplace:ListEntities", "Resource": "*" }, { "Effect": "Allow", "Action": [ "vendor-insights:CreateDataSource", "vendor-insights:DeleteDataSource", "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:CreateSecurityProfile", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:AssociateDataSource", "vendor-insights:DisassociateDataSource", "vendor-insights:UpdateSecurityProfile", "vendor-insights:ActivateSecurityProfile", "vendor-insights:DeactivateSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:AgreementType": "VendorInsightsAgreement" } } } ] } }, "v2": { "createdDate": "2022-12-01T00:49:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aws-marketplace:DescribeEntity", "Resource": "arn:aws:aws-marketplace:*:*:*/SaaSProduct/*" }, { "Effect": "Allow", "Action": "aws-marketplace:ListEntities", "Resource": "*" }, { "Effect": "Allow", "Action": [ "vendor-insights:CreateDataSource", "vendor-insights:DeleteDataSource", "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:CreateSecurityProfile", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:AssociateDataSource", "vendor-insights:DisassociateDataSource", "vendor-insights:UpdateSecurityProfile", "vendor-insights:ActivateSecurityProfile", "vendor-insights:DeactivateSecurityProfile", "vendor-insights:UpdateSecurityProfileSnapshotCreationConfiguration", "vendor-insights:UpdateSecurityProfileSnapshotReleaseConfiguration", "vendor-insights:ListSecurityProfileSnapshots", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:TagResource", "vendor-insights:UntagResource", "vendor-insights:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:CancelAgreement", "aws-marketplace:SearchAgreements" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:AgreementType": "VendorInsightsAgreement" } } }, { "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "arn:aws:artifact:*::report/*" } ] } }, "v3": { "createdDate": "2022-07-26T15:05:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aws-marketplace:DescribeEntity", "Resource": "arn:aws:aws-marketplace:*:*:*/SaaSProduct/*" }, { "Effect": "Allow", "Action": "aws-marketplace:ListEntities", "Resource": "*" }, { "Effect": "Allow", "Action": [ "vendor-insights:CreateDataSource", "vendor-insights:UpdateDataSource", "vendor-insights:DeleteDataSource", "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:CreateSecurityProfile", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:AssociateDataSource", "vendor-insights:DisassociateDataSource", "vendor-insights:UpdateSecurityProfile", "vendor-insights:ActivateSecurityProfile", "vendor-insights:DeactivateSecurityProfile", "vendor-insights:UpdateSecurityProfileSnapshotCreationConfiguration", "vendor-insights:UpdateSecurityProfileSnapshotReleaseConfiguration", "vendor-insights:ListSecurityProfileSnapshots", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:TagResource", "vendor-insights:UntagResource", "vendor-insights:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:AcceptAgreementApprovalRequest", "aws-marketplace:RejectAgreementApprovalRequest", "aws-marketplace:GetAgreementApprovalRequest", "aws-marketplace:ListAgreementApprovalRequests", "aws-marketplace:CancelAgreement", "aws-marketplace:SearchAgreements" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:AgreementType": "VendorInsightsAgreement" } } }, { "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "arn:aws:artifact:*::report/*" } ] } } }, "createdDate": "2022-07-26T15:05:27.000Z", "lastUpdatedDate": "2023-10-19T01:41:01.000Z" }, "AWSVendorInsightsVendorReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSVendorInsightsVendorReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-07-26T15:05:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aws-marketplace:DescribeEntity", "Resource": "arn:aws:aws-marketplace:*:*:*/SaaSProduct/*" }, { "Effect": "Allow", "Action": "aws-marketplace:ListEntities", "Resource": "*" }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-12-01T00:54:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aws-marketplace:DescribeEntity", "Resource": "arn:aws:aws-marketplace:*:*:*/SaaSProduct/*" }, { "Effect": "Allow", "Action": "aws-marketplace:ListEntities", "Resource": "*" }, { "Effect": "Allow", "Action": [ "vendor-insights:GetDataSource", "vendor-insights:ListDataSources", "vendor-insights:ListSecurityProfiles", "vendor-insights:GetSecurityProfile", "vendor-insights:GetSecurityProfileSnapshot", "vendor-insights:ListSecurityProfileSnapshots", "vendor-insights:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "arn:aws:artifact:*::report/*" } ] } } }, "createdDate": "2022-07-26T15:05:34.000Z", "lastUpdatedDate": "2022-12-01T00:54:38.000Z" }, "AWSVendorInsightsAssessorFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSVendorInsightsAssessorFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-07-26T15:05:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vendor-insights:GetProfileAccessTerms", "vendor-insights:ListEntitledSecurityProfiles", "vendor-insights:GetEntitledSecurityProfileSnapshot", "vendor-insights:ListEntitledSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:CreateAgreementRequest", "aws-marketplace:GetAgreementRequest", "aws-marketplace:AcceptAgreementRequest", "aws-marketplace:CancelAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:CancelAgreement" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:AgreementType": "VendorInsightsAgreement" } } } ] } }, "v2": { "createdDate": "2022-12-01T00:51:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vendor-insights:GetProfileAccessTerms", "vendor-insights:ListEntitledSecurityProfiles", "vendor-insights:GetEntitledSecurityProfileSnapshot", "vendor-insights:ListEntitledSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:CreateAgreementRequest", "aws-marketplace:GetAgreementRequest", "aws-marketplace:AcceptAgreementRequest", "aws-marketplace:CancelAgreementRequest", "aws-marketplace:ListAgreementRequests", "aws-marketplace:SearchAgreements", "aws-marketplace:CancelAgreement" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws-marketplace:AgreementType": "VendorInsightsAgreement" } } }, { "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "arn:aws:artifact:*::report/*" } ] } } }, "createdDate": "2022-07-26T15:05:40.000Z", "lastUpdatedDate": "2022-12-01T00:51:44.000Z" }, "AWSVendorInsightsAssessorReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSVendorInsightsAssessorReadOnly", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2022-12-01T00:55:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vendor-insights:ListEntitledSecurityProfiles", "vendor-insights:GetEntitledSecurityProfileSnapshot", "vendor-insights:ListEntitledSecurityProfileSnapshots" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "arn:aws:artifact:*::report/*" } ] } }, "v1": { "createdDate": "2022-07-26T15:05:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vendor-insights:ListEntitledSecurityProfiles", "vendor-insights:GetEntitledSecurityProfileSnapshot", "vendor-insights:ListEntitledSecurityProfileSnapshots" ], "Resource": "*" } ] } } }, "createdDate": "2022-07-26T15:05:56.000Z", "lastUpdatedDate": "2022-12-01T00:55:16.000Z" }, "AWSLicenseManagerUserSubscriptionsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerUserSubscriptionsServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-07-30T01:17:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSReadPermissions", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:GetAuthorizedApplicationDetails" ], "Resource": "*" }, { "Sid": "SSMReadPermissions", "Effect": "Allow", "Action": [ "ssm:GetInventory", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "EC2ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "EC2WritePermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags" ], "Condition": { "StringEquals": { "ec2:productCode": [ "bz0vcy31ooqlzk5tsash4r1ik", "d44g89hc0gp9jdzm99rznthpw" ] } }, "Resource": [ "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SSMDocumentExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunPowerShellScript" ] }, { "Sid": "SSMInstanceExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSLicenseManager": "UserSubscriptions" } } } ] } }, "v2": { "createdDate": "2022-10-25T19:22:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSReadPermissions", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:GetAuthorizedApplicationDetails" ], "Resource": "*" }, { "Sid": "SSMReadPermissions", "Effect": "Allow", "Action": [ "ssm:GetInventory", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "EC2ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "EC2WritePermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags" ], "Condition": { "StringEquals": { "ec2:productCode": [ "bz0vcy31ooqlzk5tsash4r1ik", "d44g89hc0gp9jdzm99rznthpw", "77yzkpa7kvee1y1tt7wnsdwoc" ] } }, "Resource": [ "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SSMDocumentExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunPowerShellScript" ] }, { "Sid": "SSMInstanceExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSLicenseManager": "UserSubscriptions" } } } ] } }, "v3": { "createdDate": "2022-11-21T19:51:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSReadPermissions", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:GetAuthorizedApplicationDetails" ], "Resource": "*" }, { "Sid": "SSMReadPermissions", "Effect": "Allow", "Action": [ "ssm:GetInventory", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "EC2ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVpcPeeringConnections" ], "Resource": "*" }, { "Sid": "EC2WritePermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags" ], "Condition": { "StringEquals": { "ec2:productCode": [ "bz0vcy31ooqlzk5tsash4r1ik", "d44g89hc0gp9jdzm99rznthpw", "77yzkpa7kvee1y1tt7wnsdwoc" ] } }, "Resource": [ "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SSMDocumentExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunPowerShellScript" ] }, { "Sid": "SSMInstanceExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSLicenseManager": "UserSubscriptions" } } } ] } }, "v4": { "createdDate": "2022-07-30T01:17:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSReadPermissions", "Effect": "Allow", "Action": [ "ds:DescribeDirectories", "ds:GetAuthorizedApplicationDetails" ], "Resource": "*" }, { "Sid": "SSMReadPermissions", "Effect": "Allow", "Action": [ "ssm:GetInventory", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "EC2ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVpcPeeringConnections" ], "Resource": "*" }, { "Sid": "EC2WritePermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:CreateTags" ], "Condition": { "StringEquals": { "ec2:productCode": [ "bz0vcy31ooqlzk5tsash4r1ik", "d44g89hc0gp9jdzm99rznthpw", "77yzkpa7kvee1y1tt7wnsdwoc", "a8jthu9h8pjsn4b8ylvfl6sfr", "7at6der8hnlov1g347e6tdkde", "3t0v0vuhvxjzm6m462f9v8iz4", "4gs2prcp03ojilgkjx8m3ifh7" ] } }, "Resource": [ "arn:aws:ec2:*:*:instance/*" ] }, { "Sid": "SSMDocumentExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunPowerShellScript" ] }, { "Sid": "SSMInstanceExecutionPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSLicenseManager": "UserSubscriptions" } } }, { "Sid": "ReadHostedZonePermissions", "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:ListResourceRecordSets" ], "Resource": "*" }, { "Sid": "ReadSecurityGroupRulePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroupRules" ], "Resource": "*" }, { "Effect": "Allow", "Sid": "DescribeSubnetsPermissions", "Action": [ "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeNetworkInterfacePermissions", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "ReadSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:license-manager-user-*" } ] } } }, "createdDate": "2022-07-30T01:17:18.000Z", "lastUpdatedDate": "2024-11-08T02:54:26.000Z" }, "AWSTrustedAdvisorPriorityFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSTrustedAdvisorPriorityFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-16T16:08:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "trustedadvisor:DescribeAccount*", "trustedadvisor:DescribeOrganization", "trustedadvisor:DescribeRisk*", "trustedadvisor:DownloadRisk", "trustedadvisor:UpdateRiskStatus", "trustedadvisor:DescribeNotificationConfigurations", "trustedadvisor:UpdateNotificationConfigurations", "trustedadvisor:DeleteNotificationConfigurationForDelegatedAdmin", "trustedadvisor:SetOrganizationAccess" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "reporting.trustedadvisor.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/reporting.trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisorReporting", "Condition": { "StringLike": { "iam:AWSServiceName": "reporting.trustedadvisor.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "arn:aws:organizations::*:*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "reporting.trustedadvisor.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-08-16T16:08:24.000Z", "lastUpdatedDate": "2022-08-16T16:08:24.000Z" }, "AWSTrustedAdvisorPriorityReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSTrustedAdvisorPriorityReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-16T16:35:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "trustedadvisor:DescribeAccount*", "trustedadvisor:DescribeOrganization", "trustedadvisor:DescribeRisk*", "trustedadvisor:DownloadRisk", "trustedadvisor:DescribeNotificationConfigurations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "reporting.trustedadvisor.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-08-16T16:35:12.000Z", "lastUpdatedDate": "2022-08-16T16:35:12.000Z" }, "AWSApplicationDiscoveryAgentlessCollectorAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationDiscoveryAgentlessCollectorAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-16T21:00:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "arsenal:RegisterOnPremisesAgent" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr-public:DescribeImages" ], "Resource": "arn:aws:ecr-public::446372222237:repository/6e5498e4-8c31-4f57-9991-13b4b992ff7b" }, { "Effect": "Allow", "Action": [ "ecr-public:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgh:GetHomeRegion" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sts:GetServiceBearerToken" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-16T21:00:59.000Z", "lastUpdatedDate": "2022-08-16T21:00:59.000Z" }, "AWSSupportAppFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSupportAppFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-22T16:53:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "servicequotas:GetRequestedServiceQuotaChange", "servicequotas:GetServiceQuota", "servicequotas:RequestServiceQuotaIncrease", "support:AddAttachmentsToSet", "support:AddCommunicationToCase", "support:CreateCase", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeSeverityLevels", "support:InitiateChatForCase", "support:ResolveCase" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicequotas.amazonaws.com" } } } ] } } }, "createdDate": "2022-08-22T16:53:41.000Z", "lastUpdatedDate": "2022-08-22T16:53:41.000Z" }, "AWSSupportAppReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSupportAppReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-22T17:01:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "support:DescribeCases", "support:DescribeCommunications" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-22T17:01:15.000Z", "lastUpdatedDate": "2022-08-22T17:01:15.000Z" }, "AmazonEKSLocalOutpostServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSLocalOutpostServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2022-10-24T16:24:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcAttribute", "ec2:DescribePlacementGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:placement-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:TerminateInstances", "ec2:GetConsoleOutput" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*", "eks*" ] }, "StringEquals": { "ec2:CreateAction": [ "CreateNetworkInterface", "CreateSecurityGroup", "RunInstances" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*", "eks*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "secretsmanager:DeleteSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "secretsmanager:DescribeSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-local-*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ssm:*::document/AmazonEKS-ControlPlaneInstanceProxy" }, { "Effect": "Allow", "Action": [ "ssm:ResumeSession", "ssm:TerminateSession" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "outposts:GetOutpost" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2022-08-23T21:53:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeAddresses", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*", "eks*" ] }, "StringEquals": { "ec2:CreateAction": [ "CreateNetworkInterface", "CreateSecurityGroup", "RunInstances" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*", "eks*" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "StringLike": { "aws:RequestTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*", "Condition": { "StringLike": { "aws:ResourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/eks-local-*" }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ssm:resourceTag/eks-local:controlplane-name": "*" } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": "arn:aws:ssm:*::document/AmazonEKS-ControlPlaneInstanceProxy" }, { "Effect": "Allow", "Action": [ "ssm:ResumeSession", "ssm:TerminateSession" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "outposts:GetOutpost" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-23T21:53:02.000Z", "lastUpdatedDate": "2022-10-24T16:24:51.000Z" }, "AmazonSageMakerCanvasForecastAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerCanvasForecastAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-24T20:04:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*/Canvas*", "arn:aws:s3:::sagemaker-*/canvas*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ] } ] } } }, "createdDate": "2022-08-24T20:04:20.000Z", "lastUpdatedDate": "2022-08-24T20:04:20.000Z" }, "AmazonEKSLocalOutpostClusterPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSLocalOutpostClusterPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-08-24T21:56:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:DescribeInstanceProperties", "ssm:DescribeDocumentParameters", "ssm:ListInstanceAssociations", "ssm:RegisterManagedInstance", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:PutComplianceItems", "ssm:PutInventory", "ecr-public:GetAuthorizationToken", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/eks/eks-certificates-controller-public", "arn:aws:ecr:*:*:repository/bottlerocket-admin", "arn:aws:ecr:*:*:repository/bottlerocket-control-eks", "arn:aws:ecr:*:*:repository/diagnostics-collector-eks" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource": "arn:*:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" } ] } }, "v2": { "createdDate": "2022-09-01T16:30:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:DescribeInstanceProperties", "ssm:DescribeDocumentParameters", "ssm:ListInstanceAssociations", "ssm:RegisterManagedInstance", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:PutComplianceItems", "ssm:PutInventory", "ecr-public:GetAuthorizationToken", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/eks/eks-certificates-controller-public", "arn:aws:ecr:*:*:repository/bottlerocket-admin", "arn:aws:ecr:*:*:repository/bottlerocket-control-eks", "arn:aws:ecr:*:*:repository/diagnostics-collector-eks", "arn:aws:ecr:*:*:repository/kubelet-config-updater" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource": "arn:*:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" } ] } }, "v3": { "createdDate": "2022-10-17T16:02:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:DescribeInstanceProperties", "ssm:DescribeDocumentParameters", "ssm:ListInstanceAssociations", "ssm:RegisterManagedInstance", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:PutComplianceItems", "ssm:PutInventory", "ecr-public:GetAuthorizationToken", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/eks/*", "arn:aws:ecr:*:*:repository/bottlerocket-admin", "arn:aws:ecr:*:*:repository/bottlerocket-control-eks", "arn:aws:ecr:*:*:repository/diagnostics-collector-eks", "arn:aws:ecr:*:*:repository/kubelet-config-updater" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource": "arn:*:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" } ] } }, "v4": { "createdDate": "2022-08-24T21:56:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeTags", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypes", "ec2:DescribeAvailabilityZones", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:DescribeInstanceProperties", "ssm:DescribeDocumentParameters", "ssm:ListInstanceAssociations", "ssm:RegisterManagedInstance", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:PutComplianceItems", "ssm:PutInventory", "ecr-public:GetAuthorizationToken", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/eks/*", "arn:aws:ecr:*:*:repository/bottlerocket-admin", "arn:aws:ecr:*:*:repository/bottlerocket-control-eks", "arn:aws:ecr:*:*:repository/diagnostics-collector-eks", "arn:aws:ecr:*:*:repository/kubelet-config-updater" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource": "arn:*:secretsmanager:*:*:secret:eks-local.cluster.x-k8s.io/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*" }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*:*" } ] } } }, "createdDate": "2022-08-24T21:56:47.000Z", "lastUpdatedDate": "2024-10-24T17:59:05.000Z" }, "GroundTruthSyntheticConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/GroundTruthSyntheticConsoleReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-25T15:58:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker-groundtruth-synthetic:List*", "sagemaker-groundtruth-synthetic:Get*", "s3:ListBucket" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-25T15:58:49.000Z", "lastUpdatedDate": "2022-08-25T15:58:49.000Z" }, "GroundTruthSyntheticConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/GroundTruthSyntheticConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-08-25T15:58:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker-groundtruth-synthetic:*", "s3:ListBucket" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-25T15:58:49.000Z", "lastUpdatedDate": "2022-08-25T15:58:49.000Z" }, "AmazonSSMManagedEC2InstanceDefaultPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-08-30T20:54:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-08-30T20:54:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSSMAgentPermissions", "Effect": "Allow", "Action": [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Sid": "AllowSSMChannelMessaging", "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "AllowSSMLegacyMessaging", "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" } ] } } }, "createdDate": "2022-08-30T20:54:27.000Z", "lastUpdatedDate": "2024-07-16T18:14:07.000Z" }, "AmazonSageMakerCanvasFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasFullAccess", "latestVersionId": "v11", "versionsCount": 11, "versions": { "v1": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2022-12-06T23:10:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2023-03-24T15:28:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2023-05-04T17:03:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2023-07-24T23:16:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } } ] } }, "v6": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } } ] } }, "v7": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerUserDetailsAndPackageOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups" ], "Resource": "*" }, { "Sid": "SageMakerPackageGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "SageMakerTrainingOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Sid": "SageMakerHostingOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:InvokeEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*" ] }, { "Sid": "EC2VPCOperation", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Sid": "ECROperations", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "IAMPassOperationForForecast", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Sid": "AutoscalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } } ] } }, "v8": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerUserDetailsAndPackageOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups" ], "Resource": "*" }, { "Sid": "SageMakerPackageGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "SageMakerTrainingOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Sid": "SageMakerHostingOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:InvokeEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:InvokeEndpointAsync" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*" ] }, { "Sid": "EC2VPCOperation", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Sid": "ECROperations", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "IAMPassOperationForForecast", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Sid": "AutoscalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } }, { "Sid": "AsyncEndpointOperations", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "sagemaker:DescribeEndpointConfig" ], "Resource": "*" }, { "Sid": "SageMakerCloudWatchUpdate", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "AutoscalingSageMakerEndpointOperation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v9": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerUserDetailsAndPackageOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListEndpoints" ], "Resource": "*" }, { "Sid": "SageMakerPackageGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "SageMakerTrainingOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Sid": "SageMakerHostingOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:InvokeEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:InvokeEndpointAsync" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*" ] }, { "Sid": "EC2VPCOperation", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Sid": "ECROperations", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "IAMPassOperationForForecast", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Sid": "AutoscalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } }, { "Sid": "AsyncEndpointOperations", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "sagemaker:DescribeEndpointConfig" ], "Resource": "*" }, { "Sid": "SageMakerCloudWatchUpdate", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "AutoscalingSageMakerEndpointOperation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v10": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerUserDetailsAndPackageOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListEndpoints" ], "Resource": "*" }, { "Sid": "SageMakerPackageGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "SageMakerTrainingOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:StopAutoMLJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Sid": "SageMakerHostingOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:InvokeEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:InvokeEndpointAsync" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*" ] }, { "Sid": "EC2VPCOperation", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Sid": "ECROperations", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "IAMPassOperationForForecast", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Sid": "AutoscalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } }, { "Sid": "AsyncEndpointOperations", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "sagemaker:DescribeEndpointConfig" ], "Resource": "*" }, { "Sid": "DescribeScalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingActivities" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCloudWatchUpdate", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "AutoscalingSageMakerEndpointOperation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AthenaOperation", "Action": [ "athena:ListTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueOperation", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTables" ], "Effect": "Allow", "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "QuicksightOperation", "Action": [ "quicksight:ListNamespaces" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowUseOfKeyInAccount", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/Source": "SageMakerCanvas", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessCreateApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:CreateApplication", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:ListApplications", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessApplicationOperations", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:StopApplication", "emr-serverless:GetApplication", "emr-serverless:StartApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessStartJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:StartJobRun", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:ListJobRuns", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessJobRunOperations", "Effect": "Allow", "Action": [ "emr-serverless:GetJobRun", "emr-serverless:CancelJobRun" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessTagResourceOperation", "Effect": "Allow", "Action": "emr-serverless:TagResource", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassOperationForEMRServerless", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AmazonSageMakerCanvasEMRSExecutionAccess-*", "Condition": { "StringEquals": { "iam:PassedToService": "emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v11": { "createdDate": "2022-09-09T00:44:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerUserDetailsAndPackageOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain", "sagemaker:DescribeUserProfile", "sagemaker:ListTags", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListEndpoints" ], "Resource": "*" }, { "Sid": "SageMakerPackageGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelPackage" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "SageMakerTrainingOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateCompilationJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:DeleteEndpoint", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:StopAutoMLJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:AddTags", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*", "arn:aws:sagemaker:*:*:*model-compilation-*" ] }, { "Sid": "SageMakerHostingOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:InvokeEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:InvokeEndpointAsync" ], "Resource": [ "arn:aws:sagemaker:*:*:*Canvas*", "arn:aws:sagemaker:*:*:*canvas*" ] }, { "Sid": "EC2VPCOperation", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices" ], "Resource": "*" }, { "Sid": "ECROperations", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:GetBucketCors", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": "glue:SearchTables", "Resource": [ "arn:aws:glue:*:*:table/*/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/SageMaker": "true" } } }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-data:DescribeTable" ], "Resource": "*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "IAMPassOperationForForecast", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "forecast.amazonaws.com" } } }, { "Sid": "AutoscalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "application-autoscaling:service-namespace": "sagemaker", "application-autoscaling:scalable-dimension": "sagemaker:variant:DesiredInstanceCount" } } }, { "Sid": "AsyncEndpointOperations", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "sagemaker:DescribeEndpointConfig" ], "Resource": "*" }, { "Sid": "DescribeScalingOperations", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingActivities" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCloudWatchUpdate", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "AutoscalingSageMakerEndpointOperation", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AthenaOperation", "Action": [ "athena:ListTableMetadata", "athena:ListDataCatalogs", "athena:ListDatabases" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueOperation", "Action": [ "glue:GetDatabases", "glue:GetPartitions", "glue:GetTables" ], "Effect": "Allow", "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "QuicksightOperation", "Action": [ "quicksight:ListNamespaces" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowUseOfKeyInAccount", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/Source": "SageMakerCanvas", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessCreateApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:CreateApplication", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:ListApplications", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessApplicationOperations", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:StopApplication", "emr-serverless:GetApplication", "emr-serverless:StartApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessStartJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:StartJobRun", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:ListJobRuns", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessJobRunOperations", "Effect": "Allow", "Action": [ "emr-serverless:GetJobRun", "emr-serverless:CancelJobRun" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessTagResourceOperation", "Effect": "Allow", "Action": "emr-serverless:TagResource", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassOperationForEMRServerless", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerCanvasEMRSExecutionAccess-*", "arn:aws:iam::*:role/AmazonSageMakerCanvasEMRSExecutionAccess-*" ], "Condition": { "StringEquals": { "iam:PassedToService": "emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2022-09-09T00:44:25.000Z", "lastUpdatedDate": "2024-08-16T04:35:23.000Z" }, "AmazonCloudWatchEvidentlyServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonCloudWatchEvidentlyServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-09-13T17:25:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "appconfig:StartDeployment", "Resource": [ "arn:aws:appconfig:*:*:application/*", "arn:aws:appconfig:*:*:deploymentstrategy/*" ], "Condition": { "StringEquals": { "aws:RequestTag/DeployedBy": "Evidently" } } }, { "Effect": "Deny", "Action": "appconfig:StartDeployment", "Resource": "arn:aws:appconfig:*:*:application/*/configurationprofile/*", "Condition": { "StringNotEquals": { "aws:ResourceTag/Owner": "Evidently" } } }, { "Effect": "Allow", "Action": "appconfig:TagResource", "Resource": "arn:aws:appconfig:*:*:application/*/environment/*/deployment/*", "Condition": { "StringEquals": { "aws:RequestTag/DeployedBy": "Evidently" } } }, { "Effect": "Allow", "Action": "appconfig:StopDeployment", "Resource": "arn:aws:appconfig:*:*:application/*" }, { "Effect": "Deny", "Action": "appconfig:StopDeployment", "Resource": "arn:aws:appconfig:*:*:application/*/environment/*/deployment/*", "Condition": { "StringNotEquals": { "aws:ResourceTag/DeployedBy": "Evidently" } } }, { "Effect": "Allow", "Action": "appconfig:ListDeployments", "Resource": "arn:aws:appconfig:*:*:application/*" } ] } } }, "createdDate": "2022-09-13T17:25:36.000Z", "lastUpdatedDate": "2022-09-13T17:25:36.000Z" }, "AWSDeviceFarmServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDeviceFarmServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-09-20T21:02:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/AWSDeviceFarmManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSDeviceFarmManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/AWSDeviceFarmManaged": "true" } } } ] } } }, "createdDate": "2022-09-20T21:02:28.000Z", "lastUpdatedDate": "2022-09-20T21:02:28.000Z" }, "AWSIoTFleetwiseServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIoTFleetwiseServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-09-21T23:27:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/IoTFleetWise" ] } } } ] } } }, "createdDate": "2022-09-21T23:27:48.000Z", "lastUpdatedDate": "2022-09-21T23:27:48.000Z" }, "AWSSupportPlansReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSupportPlansReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-09-27T18:08:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-09-27T18:08:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers" ], "Resource": "*" } ] } } }, "createdDate": "2022-09-27T18:08:29.000Z", "lastUpdatedDate": "2024-09-09T21:21:02.000Z" }, "AWSSupportPlansFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSupportPlansFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-09-27T18:19:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:StartSupportPlanUpdate" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-09T21:07:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:StartSupportPlanUpdate", "supportplans:CreateSupportPlanSchedule" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-09-27T18:19:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "supportplans:GetSupportPlan", "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "supportplans:StartSupportPlanUpdate", "supportplans:CreateSupportPlanSchedule" ], "Resource": "*" } ] } } }, "createdDate": "2022-09-27T18:19:30.000Z", "lastUpdatedDate": "2024-09-09T21:15:14.000Z" }, "AppIntegrationsServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AppIntegrationsServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-09-30T19:42:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AppIntegrations" } } }, { "Effect": "Allow", "Action": [ "appflow:DescribeConnectorEntity", "appflow:ListConnectorEntities" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "appflow:DescribeConnectorProfiles", "appflow:UseConnectorProfile" ], "Resource": "arn:aws:appflow:*:*:connector-profile/*" }, { "Effect": "Allow", "Action": [ "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow" ], "Condition": { "StringEquals": { "aws:ResourceTag/AppIntegrationsManaged": "true" } }, "Resource": "arn:aws:appflow:*:*:flow/FlowCreatedByAppIntegrations-*" }, { "Effect": "Allow", "Action": [ "appflow:TagResource" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AppIntegrationsManaged" ] } }, "Resource": "arn:aws:appflow:*:*:flow/FlowCreatedByAppIntegrations-*" } ] } } }, "createdDate": "2022-09-30T19:42:56.000Z", "lastUpdatedDate": "2022-09-30T19:42:56.000Z" }, "AmazonAppStreamPCAAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonAppStreamPCAAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-10-24T17:05:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:GetCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "arn:*:acm-pca:*:*:*", "Condition": { "StringLike": { "aws:ResourceTag/euc-private-ca": "*" } } } ] } } }, "createdDate": "2022-10-24T17:05:03.000Z", "lastUpdatedDate": "2022-10-24T17:05:03.000Z" }, "AWSRefactoringToolkitSidecarPolicy": { "arn": "arn:aws:iam::aws:policy/AWSRefactoringToolkitSidecarPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-10-25T16:41:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssmmessages:OpenControlChannel", "ssmmessages:CreateControlChannel" ], "Resource": "*" }, { "Sid": "S3GetObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/refactoringtoolkit*" }, { "Sid": "S3ListBucketAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "refactoringtoolkit*" } } } ] } }, "v2": { "createdDate": "2022-10-29T22:15:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssmmessages:OpenControlChannel", "ssmmessages:CreateControlChannel", "ssmmessages:OpenDataChannel", "ssmmessages:CreateDataChannel" ], "Resource": "*" }, { "Sid": "S3GetObjectAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::*/refactoringtoolkit*" }, { "Sid": "S3ListBucketAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "refactoringtoolkit*" } } } ] } } }, "createdDate": "2022-10-25T16:41:12.000Z", "lastUpdatedDate": "2022-10-29T22:15:51.000Z" }, "AWSRefactoringToolkitFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v3": { "createdDate": "2023-03-23T23:14:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "App2ContainerAccess", "Effect": "Allow", "Action": [ "a2c:GetContainerizationJobDetails", "a2c:GetDeploymentJobDetails", "a2c:StartContainerizationJob", "a2c:StartDeploymentJob" ], "Resource": "*" }, { "Sid": "CloudformationExecutionAccess", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateStack" ], "Resource": [ "arn:*:cloudformation:*:*:stack/a2c-app-*", "arn:*:cloudformation:*:*:stack/a2c-build-*" ] }, { "Sid": "CodeBuildCreateAccess", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:UpdateProject" ], "Resource": "arn:aws:codebuild:*:*:project/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "CodeBuildExecutionAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/*" }, { "Sid": "CreateSecurityGroupAccess", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Sid": "Ec2CreateAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "Ec2ModifyAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcrCreateAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcrModifyAccess", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsCreateAccess", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcsModifyAccess", "Effect": "Allow", "Action": [ "ecs:TagResource", "ecs:UntagResource", "ecs:UpdateService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsReadTaskDefinitionAccess", "Effect": "Allow", "Action": [ "ecs:DescribeTaskDefinition" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" } } }, { "Sid": "EcsExecuteCommandInSidecar", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "a2c-sidecar" } } }, { "Sid": "CreateEcsServiceLinkedRoleAccess", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Sid": "CloudwatchCreateAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "a2c-generated" ] } } }, { "Sid": "CloudwatchGetAccess", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "SsmParameterAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:PutParameter", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*" }, { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "S3ObjectAccess", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/refactoringtoolkit*", "arn:aws:s3:::*/a2c-generated*" ] }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "refactoringtoolkit*" } } }, { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks", "clouddirectory:ListDirectories", "codebuild:BatchGetProjects", "codebuild:BatchGetBuilds", "ds:DescribeDirectories", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:ListTagsForResource", "ecs:ListTasks", "iam:ListRoles", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:ListAllMyBuckets", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "GetECSSLR", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, { "Sid": "PortingAssistantFullAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws.portingassistant.dotnet.datastore", "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*" ] } ] } }, "v1": { "createdDate": "2022-10-25T16:41:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "App2ContainerAccess", "Effect": "Allow", "Action": [ "a2c:GetContainerizationJobDetails", "a2c:GetDeploymentJobDetails", "a2c:StartContainerizationJob", "a2c:StartDeploymentJob" ], "Resource": "*" }, { "Sid": "CloudformationExecutionAccess", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateStack" ], "Resource": [ "arn:*:cloudformation:*:*:stack/a2c-app-*", "arn:*:cloudformation:*:*:stack/a2c-build-*" ] }, { "Sid": "CodeBuildCreateAccess", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:UpdateProject" ], "Resource": "arn:aws:codebuild:*:*:project/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "CodeBuildExecutionAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/*" }, { "Sid": "CreateSecurityGroupAccess", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Sid": "Ec2CreateAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "Ec2ModifyAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcrCreateAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcrModifyAccess", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsCreateAccess", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcsModifyAccess", "Effect": "Allow", "Action": [ "ecs:TagResource", "ecs:UntagResource", "ecs:UpdateService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsReadTaskDefinitionAccess", "Effect": "Allow", "Action": [ "ecs:DescribeTaskDefinition" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" } } }, { "Sid": "EcsExecuteCommandInSidecar", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "a2c-sidecar" } } }, { "Sid": "CreateEcsServiceLinkedRoleAccess", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Sid": "CloudwatchAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ] }, { "Sid": "SsmParameterAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:PutParameter", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*" }, { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "S3ObjectAccess", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/refactoringtoolkit*", "arn:aws:s3:::*/a2c-generated*" ] }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "refactoringtoolkit*" } } }, { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "clouddirectory:ListDirectories", "codebuild:BatchGetProjects", "codebuild:BatchGetBuilds", "ds:DescribeDirectories", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:ListTagsForResource", "ecs:ListTasks", "iam:ListRoles", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:ListAllMyBuckets", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "GetECSSLR", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, { "Sid": "PortingAssistantFullAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws.portingassistant.dotnet.datastore", "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*" ] } ] } }, "v2": { "createdDate": "2022-12-16T23:26:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "App2ContainerAccess", "Effect": "Allow", "Action": [ "a2c:GetContainerizationJobDetails", "a2c:GetDeploymentJobDetails", "a2c:StartContainerizationJob", "a2c:StartDeploymentJob" ], "Resource": "*" }, { "Sid": "CloudformationExecutionAccess", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateStack" ], "Resource": [ "arn:*:cloudformation:*:*:stack/a2c-app-*", "arn:*:cloudformation:*:*:stack/a2c-build-*" ] }, { "Sid": "CodeBuildCreateAccess", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:UpdateProject" ], "Resource": "arn:aws:codebuild:*:*:project/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "CodeBuildExecutionAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/*" }, { "Sid": "CreateSecurityGroupAccess", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Sid": "Ec2CreateAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "Ec2ModifyAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcrCreateAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcrModifyAccess", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsCreateAccess", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcsModifyAccess", "Effect": "Allow", "Action": [ "ecs:TagResource", "ecs:UntagResource", "ecs:UpdateService" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsReadTaskDefinitionAccess", "Effect": "Allow", "Action": [ "ecs:DescribeTaskDefinition" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" } } }, { "Sid": "EcsExecuteCommandInSidecar", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "a2c-sidecar" } } }, { "Sid": "CreateEcsServiceLinkedRoleAccess", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Sid": "CloudwatchCreateAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "a2c-generated" ] } } }, { "Sid": "CloudwatchGetAccess", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "SsmParameterAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:PutParameter", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*" }, { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "S3ObjectAccess", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/refactoringtoolkit*", "arn:aws:s3:::*/a2c-generated*" ] }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": "refactoringtoolkit*" } } }, { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "clouddirectory:ListDirectories", "codebuild:BatchGetProjects", "codebuild:BatchGetBuilds", "ds:DescribeDirectories", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:ListTagsForResource", "ecs:ListTasks", "iam:ListRoles", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:ListAllMyBuckets", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "GetECSSLR", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, { "Sid": "PortingAssistantFullAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws.portingassistant.dotnet.datastore", "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*" ] } ] } }, "v4": { "createdDate": "2022-10-25T16:41:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "App2ContainerAccess", "Effect": "Allow", "Action": [ "a2c:GetContainerizationJobDetails", "a2c:GetDeploymentJobDetails", "a2c:StartContainerizationJob", "a2c:StartDeploymentJob" ], "Resource": "*" }, { "Sid": "CloudformationExecutionAccess", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateStack" ], "Resource": [ "arn:*:cloudformation:*:*:stack/a2c-app-*", "arn:*:cloudformation:*:*:stack/a2c-build-*", "arn:*:cloudformation:*:*:stack/application-transformation-app-*" ] }, { "Sid": "CodeBuildCreateAccess", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:UpdateProject" ], "Resource": "arn:aws:codebuild:*:*:project/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "CodeBuildExecutionAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/*" }, { "Sid": "CreateSecurityGroupAccess", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Sid": "Ec2CreateAccess", "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "Ec2CreateAccessATS", "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "Ec2ModifyAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress", "ec2:CreateSubnet", "ec2:CreateRoute", "ec2:CreateRouteTable" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "Ec2ModifyAccessATS", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress", "ec2:CreateSubnet", "ec2:CreateRoute", "ec2:CreateRouteTable" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcrCreateAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcrCreateAccessATS", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "EcrModifyAccess", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcrModifyAccessATS", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcsCreateAccess", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcsCreateAccessATS", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "EcsModifyAccess", "Effect": "Allow", "Action": [ "ecs:UpdateService", "ecs:TagResource", "ecs:UntagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsModifyAccessATS", "Effect": "Allow", "Action": [ "ecs:UpdateService", "ecs:TagResource", "ecs:UntagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcsReadTaskDefinitionAccess", "Effect": "Allow", "Action": [ "ecs:DescribeTaskDefinition" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" } } }, { "Sid": "EcsExecuteCommandInSidecar", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "a2c-sidecar" } } }, { "Sid": "EcsExecuteCommandInSidecarATS", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "application-transformation-sidecar" } } }, { "Sid": "CreateEcsServiceLinkedRoleAccess", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Sid": "CloudwatchCreateAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "a2c-generated" ] } } }, { "Sid": "CloudwatchCreateAccessATS", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "application-transformation" ] } } }, { "Sid": "CloudwatchGetAccess", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "CloudwatchGetAccessATS", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "SsmParameterAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:PutParameter", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*" }, { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "S3ObjectAccess", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/refactoringtoolkit*", "arn:aws:s3:::*/a2c-generated*", "arn:aws:s3:::*/application-transformation*" ] }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": [ "application-transformation", "refactoringtoolkit" ] } } }, { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks", "clouddirectory:ListDirectories", "codebuild:BatchGetProjects", "codebuild:BatchGetBuilds", "ds:DescribeDirectories", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRegions", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:ListTagsForResource", "ecs:ListTasks", "iam:ListRoles", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:ListAllMyBuckets", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "GetECSSLR", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, { "Sid": "PortingAssistantFullAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws.portingassistant.dotnet.datastore", "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*" ] }, { "Sid": "ApplicationTransformationAccess", "Effect": "Allow", "Action": [ "application-transformation:StartPortingCompatibilityAssessment", "application-transformation:GetPortingCompatibilityAssessment", "application-transformation:StartPortingRecommendationAssessment", "application-transformation:GetPortingRecommendationAssessment", "application-transformation:PutLogData", "application-transformation:PutMetricData", "application-transformation:StartContainerization", "application-transformation:GetContainerization", "application-transformation:StartDeployment", "application-transformation:GetDeployment" ], "Resource": "*" }, { "Sid": "KmsAccess", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*::*", "Condition": { "ForAnyValue:StringLike": { "kms:ResourceAliases": "alias/application-transformation*" } } }, { "Sid": "EcrPushAccess", "Effect": "Allow", "Action": [ "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "ecr:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcrAuthAccess", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "KmsCreateGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*::*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "ForAnyValue:StringLike": { "kms:ResourceAliases": "alias/application-transformation*" } } } ] } }, "v5": { "createdDate": "2022-10-25T16:41:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "App2ContainerAccess", "Effect": "Allow", "Action": [ "a2c:GetContainerizationJobDetails", "a2c:GetDeploymentJobDetails", "a2c:StartContainerizationJob", "a2c:StartDeploymentJob" ], "Resource": "*" }, { "Sid": "CloudformationExecutionAccess", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackEvents", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateStack", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": [ "arn:*:cloudformation:*:*:stack/a2c-app-*", "arn:*:cloudformation:*:*:stack/a2c-build-*", "arn:*:cloudformation:*:*:stack/application-transformation-app-*" ] }, { "Sid": "CodeBuildCreateAccess", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:UpdateProject" ], "Resource": "arn:aws:codebuild:*:*:project/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "CodeBuildExecutionAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild" ], "Resource": "arn:aws:codebuild:*:*:project/*" }, { "Sid": "CreateSecurityGroupAccess", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "*" }, { "Sid": "Ec2CreateAccess", "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "Ec2CreateAccessATS", "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "Ec2ModifyAccess", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress", "ec2:CreateSubnet", "ec2:CreateRoute", "ec2:CreateRouteTable" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "Ec2ModifyAccessATS", "Effect": "Allow", "Action": [ "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteTags", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RevokeSecurityGroupIngress", "ec2:CreateSubnet", "ec2:CreateRoute", "ec2:CreateRouteTable" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcrCreateAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcrCreateAccessATS", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "EcrModifyAccess", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcrModifyAccessATS", "Effect": "Allow", "Action": [ "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecr:TagResource", "ecr:UntagResource" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcsCreateAccess", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" } } }, { "Sid": "EcsCreateAccessATS", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:CreateService", "ecs:RegisterTaskDefinition", "ecs:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" } } }, { "Sid": "EcsModifyAccess", "Effect": "Allow", "Action": [ "ecs:UpdateService", "ecs:TagResource", "ecs:UntagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "EcsModifyAccessATS", "Effect": "Allow", "Action": [ "ecs:UpdateService", "ecs:TagResource", "ecs:UntagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcsReadTaskDefinitionAccess", "Effect": "Allow", "Action": [ "ecs:DescribeTaskDefinition" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" } } }, { "Sid": "EcsExecuteCommandInSidecar", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "a2c-sidecar" } } }, { "Sid": "EcsExecuteCommandInSidecarATS", "Effect": "Allow", "Action": [ "ecs:ExecuteCommand" ], "Resource": "*", "Condition": { "StringLike": { "ecs:container-name": "application-transformation-sidecar" } } }, { "Sid": "CreateEcsServiceLinkedRoleAccess", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition": { "StringLike": { "iam:AWSServiceName": "ecs.amazonaws.com" } } }, { "Sid": "CloudwatchCreateAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/a2c-generated": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "a2c-generated" ] } } }, { "Sid": "CloudwatchCreateAccessATS", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:RequestTag/application-transformation": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "application-transformation" ] } } }, { "Sid": "CloudwatchGetAccess", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/a2c-generated": "false" } } }, { "Sid": "CloudwatchGetAccessATS", "Effect": "Allow", "Action": [ "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*", "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*" ], "Condition": { "Null": { "aws:ResourceTag/application-transformation": "false" } } }, { "Sid": "SsmParameterAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:PutParameter", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*" }, { "Sid": "SsmMessagesAccess", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Sid": "S3ObjectAccess", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*/refactoringtoolkit*", "arn:aws:s3:::*/a2c-generated*", "arn:aws:s3:::*/application-transformation*" ] }, { "Sid": "S3ListAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringLike": { "s3:prefix": [ "application-transformation", "refactoringtoolkit" ] } } }, { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks", "clouddirectory:ListDirectories", "codebuild:BatchGetProjects", "codebuild:BatchGetBuilds", "ds:DescribeDirectories", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRegions", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecs:DescribeClusters", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:ListTagsForResource", "ecs:ListTasks", "iam:ListRoles", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:ListAllMyBuckets", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "GetECSSLR", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, { "Sid": "PortingAssistantFullAccess", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws.portingassistant.dotnet.datastore", "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*" ] }, { "Sid": "ApplicationTransformationAccess", "Effect": "Allow", "Action": [ "application-transformation:StartPortingCompatibilityAssessment", "application-transformation:GetPortingCompatibilityAssessment", "application-transformation:StartPortingRecommendationAssessment", "application-transformation:GetPortingRecommendationAssessment", "application-transformation:PutLogData", "application-transformation:PutMetricData", "application-transformation:StartContainerization", "application-transformation:GetContainerization", "application-transformation:StartDeployment", "application-transformation:GetDeployment" ], "Resource": "*" }, { "Sid": "KmsAccess", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*::*", "Condition": { "ForAnyValue:StringLike": { "kms:ResourceAliases": "alias/application-transformation*" } } }, { "Sid": "EcrPushAccess", "Effect": "Allow", "Action": [ "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:*:ecr:*:*:repository/*", "Condition": { "Null": { "ecr:ResourceTag/application-transformation": "false" } } }, { "Sid": "EcrAuthAccess", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "KmsCreateGrantAccess", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*::*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "ForAnyValue:StringLike": { "kms:ResourceAliases": "alias/application-transformation*" } } } ] } } }, "createdDate": "2022-10-25T16:41:15.000Z", "lastUpdatedDate": "2024-03-25T18:43:14.000Z" }, "AWSResourceExplorerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSResourceExplorerServiceRolePolicy", "latestVersionId": "v13", "versionsCount": 13, "versions": { "v1": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "es:ListDomainNames", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListStorageLensConfigurations", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "sns:ListTopics", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2022-10-31T17:23:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "es:ListDomainNames", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListStorageLensConfigurations", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "sns:ListTopics", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2023-01-26T14:43:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeUsers", "elasticache:DescribeUserGroups", "es:ListDomainNames", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListStorageLensConfigurations", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "sns:ListTopics", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "sqs:ListQueues" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2023-08-01T19:33:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Effect": "Allow", "Action": [ "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFunctions", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codebuild:ListProjects", "codepipeline:ListPipelines", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeUsers", "elasticache:DescribeUserGroups", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeFileSystems", "es:ListDomainNames", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iot:ListPolicies", "iot:ListTopicRules", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "sns:ListTopics", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListStateMachines", "sqs:ListQueues" ], "Resource": [ "*" ] } ] } }, "v5": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Sid": "ApiGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "apprunner:ListServices", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "databrew:ListDatasets", "databrew:ListRecipes", "databrew:ListRulesets", "detective:ListGraphs", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpams", "ec2:DescribeIpamScopes", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr:DescribeRepositories", "ecr-public:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "es:ListDomainNames", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetLabels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "gamelift:ListAliases", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "greengrass:ListGroups", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iot:ListJobTemplates", "iot:ListAuthorizers", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "ivs:ListChannels", "ivs:ListStreamKeys", "kafka:ListClusters", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisvideo:ListStreams", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "panorama:ListPackages", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm-incidents:ListResponsePlans", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "timestream:ListDatabases", "wisdom:listAssistantAssociations", "wisdom:ListAssistants", "wisdom:listKnowledgeBases" ], "Resource": [ "*" ] } ] } }, "v6": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Sid": "ApiGatewayAccess", "Action": [ "apigateway:GET" ], "Effect": "Allow", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "apprunner:ListServices", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "databrew:ListDatasets", "databrew:ListRecipes", "databrew:ListRulesets", "detective:ListGraphs", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpams", "ec2:DescribeIpamScopes", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr:DescribeRepositories", "ecr-public:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "es:ListDomainNames", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetLabels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "gamelift:ListAliases", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "greengrass:ListGroups", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iot:ListJobTemplates", "iot:ListAuthorizers", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListGateways", "iottwinmaker:ListWorkspaces", "ivs:ListChannels", "ivs:ListStreamKeys", "kafka:ListClusters", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisvideo:ListStreams", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm-incidents:ListResponsePlans", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "timestream:ListDatabases", "wisdom:listAssistantAssociations", "wisdom:ListAssistants", "wisdom:listKnowledgeBases" ], "Resource": [ "*" ] } ] } }, "v7": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "databrew:ListDatasets", "databrew:ListRecipes", "databrew:ListRulesets", "detective:ListGraphs", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpams", "ec2:DescribeIpamScopes", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr:DescribeRepositories", "ecr-public:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetLabels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "gamelift:ListAliases", "geo:ListPlaceIndexes", "geo:ListTrackers", "greengrass:ListComponents", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "greengrass:ListComponentVersions", "greengrass:ListGroups", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iot:ListJobTemplates", "iot:ListAuthorizers", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListGateways", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "kafka:ListConfigurations", "kms:ListKeys", "ivs:ListChannels", "ivs:ListStreamKeys", "kafka:ListClusters", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lex:ListBots", "lex:ListBotAliases", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mq:ListBrokers", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "route53:ListHealthChecks", "route53:ListHostedZones", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm-incidents:ListResponsePlans", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "timestream:ListDatabases", "wisdom:listAssistantAssociations", "wisdom:ListAssistants", "wisdom:listKnowledgeBases" ], "Resource": [ "*" ] } ] } }, "v8": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" ] }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "databrew:ListDatasets", "databrew:ListRecipes", "databrew:ListRulesets", "detective:ListGraphs", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpams", "ec2:DescribeIpamScopes", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr:DescribeRepositories", "ecr-public:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetLabels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "gamelift:ListAliases", "geo:ListPlaceIndexes", "geo:ListTrackers", "greengrass:ListComponents", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "greengrass:ListComponentVersions", "greengrass:ListGroups", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iot:ListJobTemplates", "iot:ListAuthorizers", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListGateways", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "kafka:ListConfigurations", "kms:ListKeys", "ivs:ListChannels", "ivs:ListStreamKeys", "kafka:ListClusters", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayers", "lambda:ListLayerVersions", "lex:ListBots", "lex:ListBotAliases", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mq:ListBrokers", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusters", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "route53:ListHealthChecks", "route53:ListHostedZones", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm-incidents:ListResponsePlans", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "timestream:ListDatabases", "wisdom:listAssistantAssociations", "wisdom:ListAssistants", "wisdom:listKnowledgeBases" ], "Resource": [ "*" ] } ] } }, "v9": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "appflow:ListFlows", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:ListVirtualServices", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:ListAssessments", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStackSets", "cloudformation:ListStacks", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:ListPipelines", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "connect:ListInstances", "connect:ListQuickConnects", "connect:ListUsers", "databrew:ListDatasets", "databrew:ListRecipes", "databrew:ListRulesets", "databrew:ListSchedules", "datasync:ListLocations", "datasync:ListTasks", "detective:ListGraphs", "dms:DescribeEndpoints", "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr-public:DescribeRepositories", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetLabels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", "geo:ListPlaceIndexes", "geo:ListTrackers", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "glue:ListMLTransforms", "greengrass:ListComponentVersions", "greengrass:ListComponents", "greengrass:ListGroups", "groundstation:ListConfigs", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListIPSets", "guardduty:ListThreatIntelSets", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:ListAuthorizers", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjects", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "iotwireless:ListServiceProfiles", "ivs:ListChannels", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "kafka:ListClusters", "kafka:ListConfigurations", "kendra:ListIndices", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "kms:ListKeys", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lex:ListBotAliases", "lex:ListBots", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "macie2:ListCustomDataIdentifiers", "macie2:ListFindingsFilters", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetCampaigns", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:ListBrokers", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "proton:ListEnvironmentAccountConnections", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "ram:GetResourceShares", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:ListHealthChecks", "route53:ListHostedZones", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm-incidents:ListResponsePlans", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "timestream:ListDatabases", "transfer:ListWorkflows", "wisdom:ListAssistants", "wisdom:listAssistantAssociations", "wisdom:listKnowledgeBases", "workspaces:DescribeWorkspaces" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "acm:ListCertificates", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "appflow:ListFlows", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:ListVirtualServices", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:ListAssessments", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "cloudformation:ListStackSets", "cloudformation:ListStacks", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:ListPipelines", "codepipeline:ListWebhooks", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "comprehend:ListDocumentClassifiers", "comprehend:ListEntityRecognizers", "connect:ListInstances", "connect:ListQuickConnects", "connect:ListUsers", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRulesets", "databrew:ListSchedules", "dataexchange:ListDataSets", "datasync:ListLocations", "datasync:ListTasks", "detective:ListGraphs", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr-public:DescribeRepositories", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "emr-containers:ListVirtualClusters", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "fsx:DescribeFileSystems", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", "geo:ListPlaceIndexes", "geo:ListTrackers", "glacier:ListVaults", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "glue:ListMLTransforms", "greengrass:ListComponentVersions", "greengrass:ListComponents", "greengrass:ListConnectorDefinitions", "greengrass:ListCoreDefinitions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitions", "greengrass:ListResourceDefinitions", "greengrass:ListSubscriptionDefinitions", "groundstation:ListConfigs", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListIPSets", "guardduty:ListThreatIntelSets", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "iot:ListAuthorizers", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjects", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "iotwireless:ListServiceProfiles", "ivs:ListChannels", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "kafka:ListClusters", "kafka:ListConfigurations", "kendra:ListIndices", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "kms:ListKeys", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lex:ListBotAliases", "lex:ListBots", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "macie2:ListCustomDataIdentifiers", "macie2:ListFindingsFilters", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetCampaigns", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:ListBrokers", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "proton:ListEnvironmentAccountConnections", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "ram:GetResourceShares", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:ListHealthChecks", "route53:ListHostedZones", "route53domains:ListDomains", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailIdentities", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm-incidents:ListResponsePlans", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "timestream:ListDatabases", "transfer:ListWorkflows", "wisdom:ListAssistants", "wisdom:listAssistantAssociations", "wisdom:listKnowledgeBases", "workspaces:DescribeWorkspaces" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/vpclinks" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "acm:ListCertificates", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "appconfig:ListApplications", "appconfig:ListDeploymentStrategies", "appflow:ListFlows", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:ListVirtualServices", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:ListAssessments", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloudformation:ListStackSets", "cloudformation:ListStacks", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListContinuousDeploymentPolicies", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListChannels", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:ListPipelines", "codepipeline:ListWebhooks", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "comprehend:ListDocumentClassifiers", "comprehend:ListEntityRecognizers", "connect:ListInstances", "connect:ListQuickConnects", "connect:ListUsers", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRulesets", "databrew:ListSchedules", "dataexchange:ListDataSets", "datasync:ListLocations", "datasync:ListTasks", "detective:ListGraphs", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr-public:DescribeRepositories", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "emr-containers:ListVirtualClusters", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "fsx:DescribeFileSystems", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListLocations", "geo:ListPlaceIndexes", "geo:ListTrackers", "glacier:ListVaults", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "glue:ListMLTransforms", "greengrass:ListComponentVersions", "greengrass:ListComponents", "greengrass:ListConnectorDefinitions", "greengrass:ListCoreDefinitions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitions", "greengrass:ListResourceDefinitions", "greengrass:ListSubscriptionDefinitions", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListIPSets", "guardduty:ListThreatIntelSets", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector:ListAssessmentTemplates", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotdeviceadvisor:ListSuiteDefinitions", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogs", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjects", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "iotwireless:ListServiceProfiles", "ivs:ListChannels", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "kafka:ListClusters", "kafka:ListConfigurations", "kendra:ListIndices", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "kms:ListKeys", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lex:ListBotAliases", "lex:ListBots", "lightsail:GetBuckets", "lightsail:GetCertificates", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "macie2:ListCustomDataIdentifiers", "macie2:ListFindingsFilters", "managedblockchain:ListAccessors", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetCampaigns", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:ListBrokers", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "oam:ListSinks", "omics:ListReferenceStores", "omics:ListRunGroups", "omics:ListWorkflows", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "pipes:ListPipes", "proton:ListEnvironmentAccountConnections", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "ram:GetResourceShares", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:ListHealthChecks", "route53:ListHostedZones", "route53domains:ListDomains", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "schemas:ListDiscoverers", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailIdentities", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm-incidents:ListResponsePlans", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "timestream:ListDatabases", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListWorkflows", "wisdom:ListAssistants", "wisdom:listAssistantAssociations", "wisdom:listKnowledgeBases", "workspaces:DescribeWorkspaces" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/vpclinks" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "acm:ListCertificates", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "appconfig:ListApplications", "appconfig:ListDeploymentStrategies", "appflow:ListFlows", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:ListVirtualServices", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:ListAssessments", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloudformation:ListResources", "cloudformation:ListStackSets", "cloudformation:ListStacks", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListContinuousDeploymentPolicies", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListChannels", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:ListPipelines", "codepipeline:ListWebhooks", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "comprehend:ListDocumentClassifiers", "comprehend:ListEntityRecognizers", "connect:ListInstances", "connect:ListQuickConnects", "connect:ListUsers", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRulesets", "databrew:ListSchedules", "dataexchange:ListDataSets", "datasync:ListLocations", "datasync:ListTasks", "detective:ListGraphs", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr-public:DescribeRepositories", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "emr-containers:ListVirtualClusters", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListArchives", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasets", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "fsx:DescribeFileSystems", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListLocations", "geo:ListPlaceIndexes", "geo:ListTrackers", "glacier:ListVaults", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "glue:ListMLTransforms", "greengrass:ListComponentVersions", "greengrass:ListComponents", "greengrass:ListConnectorDefinitions", "greengrass:ListCoreDefinitions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitions", "greengrass:ListResourceDefinitions", "greengrass:ListSubscriptionDefinitions", "groundstation:ListConfigs", "groundstation:ListMissionProfiles", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListIPSets", "guardduty:ListThreatIntelSets", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector:ListAssessmentTemplates", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotdeviceadvisor:ListSuiteDefinitions", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogs", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjects", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListWorkspaces", "iotwireless:ListServiceProfiles", "ivs:ListChannels", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "kafka:ListClusters", "kafka:ListConfigurations", "kendra:ListIndices", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "kms:ListKeys", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lex:ListBotAliases", "lex:ListBots", "lightsail:GetBuckets", "lightsail:GetCertificates", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutvision:ListProjects", "macie2:ListCustomDataIdentifiers", "macie2:ListFindingsFilters", "managedblockchain:ListAccessors", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetCampaigns", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:ListBrokers", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "oam:ListSinks", "omics:ListReferenceStores", "omics:ListRunGroups", "omics:ListWorkflows", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "pipes:ListPipes", "proton:ListEnvironmentAccountConnections", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "ram:GetResourceShares", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:ListHealthChecks", "route53:ListHostedZones", "route53domains:ListDomains", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRules", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListStorageLensConfigurations", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "schemas:ListDiscoverers", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailIdentities", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm-incidents:ListResponsePlans", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "timestream:ListDatabases", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListWorkflows", "wisdom:ListAssistants", "wisdom:listAssistantAssociations", "wisdom:listKnowledgeBases", "workspaces:DescribeWorkspaces" ], "Resource": "*" } ] } }, "v13": { "createdDate": "2022-10-25T20:35:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailEventsAccess", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/resource-explorer-2/*" }, { "Sid": "ApiGatewayAccess", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/vpclinks" ] }, { "Sid": "ResourceInventoryAccess", "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm-pca:ListCertificateAuthorities", "acm:ListCertificates", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBackendEnvironments", "amplify:ListBranches", "amplify:ListDomainAssociations", "amplifyuibuilder:ListComponents", "amplifyuibuilder:ListThemes", "app-integrations:ListEventIntegrations", "appconfig:ListApplications", "appconfig:ListDeploymentStrategies", "appflow:ListFlows", "appmesh:ListMeshes", "appmesh:ListVirtualNodes", "appmesh:ListVirtualServices", "apprunner:ListServices", "apprunner:ListVpcConnectors", "appstream:DescribeAppBlocks", "appstream:DescribeApplications", "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", "appsync:ListGraphqlApis", "aps:ListRuleGroupsNamespaces", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", "auditmanager:ListAssessments", "autoscaling:DescribeAutoScalingGroups", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListReportPlans", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "cloud9:ListEnvironments", "cloudformation:ListResources", "cloudformation:ListStackSets", "cloudformation:ListStacks", "cloudfront:ListCachePolicies", "cloudfront:ListCloudFrontOriginAccessIdentities", "cloudfront:ListContinuousDeploymentPolicies", "cloudfront:ListDistributions", "cloudfront:ListFieldLevelEncryptionConfigs", "cloudfront:ListFieldLevelEncryptionProfiles", "cloudfront:ListFunctions", "cloudfront:ListOriginAccessControls", "cloudfront:ListOriginRequestPolicies", "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudtrail:ListChannels", "cloudtrail:ListEventDataStores", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", "codeartifact:ListDomains", "codeartifact:ListRepositories", "codebuild:ListProjects", "codecommit:ListRepositories", "codeconnections:ListConnections", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codeguru-profiler:ListProfilingGroups", "codeguru-reviewer:ListRepositoryAssociations", "codepipeline:ListPipelines", "codepipeline:ListWebhooks", "codestar-connections:ListConnections", "cognito-identity:ListIdentityPools", "cognito-idp:ListUserPools", "comprehend:ListDocumentClassifiers", "comprehend:ListEntityRecognizers", "connect:ListInstances", "connect:ListPhoneNumbersV2", "connect:ListQuickConnects", "connect:ListRules", "connect:ListTaskTemplates", "connect:ListUsers", "databrew:ListDatasets", "databrew:ListJobs", "databrew:ListProjects", "databrew:ListRecipes", "databrew:ListRulesets", "databrew:ListSchedules", "dataexchange:ListDataSets", "datapipeline:ListPipelines", "datasync:ListLocations", "datasync:ListTasks", "dax:DescribeClusters", "detective:ListGraphs", "devicefarm:ListProjects", "devicefarm:ListTestGridProjects", "dms:DescribeEndpoints", "dms:DescribeEventSubscriptions", "dms:DescribeReplicationInstances", "dms:DescribeReplicationSubnetGroups", "dms:DescribeReplicationTasks", "ds:DescribeDirectories", "dynamodb:ListStreams", "dynamodb:ListTables", "ec2:DescribeAddresses", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeElasticGpus", "ec2:DescribeExportImageTasks", "ec2:DescribeExportTasks", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeFpgaImages", "ec2:DescribeHostReservations", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeImportImageTasks", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeInstanceEventWindows", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamResourceDiscoveries", "ec2:DescribeIpamResourceDiscoveryAssociations", "ec2:DescribeIpamScopes", "ec2:DescribeIpams", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribePublicIpv4Pools", "ec2:DescribeReservedInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTableAnnouncements", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetSubnetCidrReservations", "ecr-public:DescribeRepositories", "ecr:DescribeRepositories", "ecs:DescribeCapacityProviders", "ecs:DescribeServices", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:ListClusters", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheSecurityGroups", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeReservedCacheNodes", "elasticache:DescribeSnapshots", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeEnvironments", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticmapreduce:ListClusters", "emr-containers:ListVirtualClusters", "emr-serverless:ListApplications", "es:ListDomainNames", "events:ListApiDestinations", "events:ListArchives", "events:ListConnections", "events:ListEndpoints", "events:ListEventBuses", "events:ListRules", "evidently:ListExperiments", "evidently:ListFeatures", "evidently:ListLaunches", "evidently:ListProjects", "finspace:ListEnvironments", "firehose:ListDeliveryStreams", "fis:ListExperimentTemplates", "forecast:ListDatasetGroups", "forecast:ListDatasetImportJobs", "forecast:ListDatasets", "forecast:ListForecastExportJobs", "forecast:ListForecasts", "forecast:ListPredictorBacktestExportJobs", "forecast:ListPredictors", "frauddetector:GetDetectors", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetModels", "frauddetector:GetOutcomes", "frauddetector:GetVariables", "fsx:DescribeFileSystems", "gamelift:DescribeGameSessionQueues", "gamelift:DescribeMatchmakingConfigurations", "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", "gamelift:ListLocations", "geo:ListMaps", "geo:ListPlaceIndexes", "geo:ListTrackers", "glacier:ListVaults", "globalaccelerator:ListAccelerators", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "glue:GetCrawlers", "glue:GetDatabases", "glue:GetJobs", "glue:GetTables", "glue:GetTriggers", "glue:ListMLTransforms", "grafana:ListWorkspaces", "greengrass:ListComponentVersions", "greengrass:ListComponents", "greengrass:ListConnectorDefinitions", "greengrass:ListCoreDefinitions", "greengrass:ListDeviceDefinitions", "greengrass:ListFunctionDefinitions", "greengrass:ListGroups", "greengrass:ListLoggerDefinitions", "greengrass:ListResourceDefinitions", "greengrass:ListSubscriptionDefinitions", "groundstation:ListConfigs", "groundstation:ListDataflowEndpointGroups", "groundstation:ListMissionProfiles", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListIPSets", "guardduty:ListThreatIntelSets", "healthlake:ListFHIRDatastores", "iam:ListGroups", "iam:ListInstanceProfiles", "iam:ListOpenIDConnectProviders", "iam:ListPolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUsers", "iam:ListVirtualMFADevices", "imagebuilder:ListComponentBuildVersions", "imagebuilder:ListComponents", "imagebuilder:ListContainerRecipes", "imagebuilder:ListDistributionConfigurations", "imagebuilder:ListImageBuildVersions", "imagebuilder:ListImagePipelines", "imagebuilder:ListImageRecipes", "imagebuilder:ListImages", "imagebuilder:ListInfrastructureConfigurations", "inspector:ListAssessmentTemplates", "iot:ListAuthorizers", "iot:ListCACertificates", "iot:ListCertificates", "iot:ListJobTemplates", "iot:ListMitigationActions", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListSecurityProfiles", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", "iotanalytics:ListPipelines", "iotdeviceadvisor:ListSuiteDefinitions", "iotevents:ListAlarmModels", "iotevents:ListDetectorModels", "iotevents:ListInputs", "iotfleetwise:ListDecoderManifests", "iotfleetwise:ListModelManifests", "iotfleetwise:ListSignalCatalogs", "iotfleetwise:ListVehicles", "iotsitewise:ListAssetModels", "iotsitewise:ListAssets", "iotsitewise:ListDashboards", "iotsitewise:ListGateways", "iotsitewise:ListPortals", "iotsitewise:ListProjects", "iottwinmaker:ListComponentTypes", "iottwinmaker:ListEntities", "iottwinmaker:ListScenes", "iottwinmaker:ListSyncJobs", "iottwinmaker:ListWorkspaces", "iotwireless:ListServiceProfiles", "ivs:ListChannels", "ivs:ListRecordingConfigurations", "ivs:ListStreamKeys", "ivschat:ListLoggingConfigurations", "ivschat:ListRooms", "kafka:ListClusters", "kafka:ListConfigurations", "kendra:ListIndices", "kinesis:ListStreamConsumers", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisvideo:ListStreams", "kms:ListAliases", "kms:ListKeys", "lambda:ListAliases", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lex:ListBotAliases", "lex:ListBots", "license-manager:ListDistributedGrants", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisks", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "lookoutmetrics:ListAlerts", "lookoutmetrics:ListAnomalyDetectors", "lookoutvision:ListProjects", "m2:ListEnvironments", "macie2:ListAllowLists", "macie2:ListCustomDataIdentifiers", "macie2:ListFindingsFilters", "managedblockchain:ListAccessors", "mediapackage-vod:ListPackagingConfigurations", "mediapackage-vod:ListPackagingGroups", "mediapackage:ListChannels", "mediapackage:ListOriginEndpoints", "mediatailor:ListPlaybackConfigurations", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "mobiletargeting:GetApps", "mobiletargeting:GetCampaigns", "mobiletargeting:GetSegments", "mobiletargeting:ListTemplates", "mq:ListBrokers", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "networkmanager:DescribeGlobalNetworks", "networkmanager:GetDevices", "networkmanager:GetLinks", "networkmanager:ListAttachments", "networkmanager:ListCoreNetworks", "oam:ListSinks", "omics:ListReferenceStores", "omics:ListRunGroups", "omics:ListWorkflows", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots", "outposts:ListSites", "panorama:ListPackages", "personalize:ListDatasetGroups", "personalize:ListDatasets", "personalize:ListSchemas", "personalize:ListSolutions", "pipes:ListPipes", "proton:ListEnvironmentAccountConnections", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListLedgers", "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShares", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeOptionGroups", "rds:DescribeReservedDBInstances", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterSnapshots", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeClusters", "redshift:DescribeEventSubscriptions", "redshift:DescribeSnapshotCopyGrants", "redshift:DescribeSnapshotSchedules", "redshift:DescribeUsageLimits", "refactor-spaces:ListApplications", "refactor-spaces:ListEnvironments", "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews", "resource-groups:ListGroups", "robomaker:ListRobotApplications", "robomaker:ListSimulationApplications", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListSafetyRules", "route53-recovery-readiness:ListReadinessChecks", "route53-recovery-readiness:ListRecoveryGroups", "route53-recovery-readiness:ListResourceSets", "route53:ListHealthChecks", "route53:ListHostedZones", "route53domains:ListDomains", "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverRules", "rum:ListAppMonitors", "s3:GetBucketLocation", "s3:ListAccessPoints", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "sagemaker:ListAppImageConfigs", "sagemaker:ListDomains", "sagemaker:ListEndpoints", "sagemaker:ListFeatureGroups", "sagemaker:ListImages", "sagemaker:ListModels", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelines", "scheduler:ListScheduleGroups", "scheduler:ListSchedules", "schemas:ListDiscoverers", "secretsmanager:ListSecrets", "servicecatalog:ListApplications", "servicecatalog:ListAttributeGroups", "servicediscovery:ListServices", "ses:ListConfigurationSets", "ses:ListContactLists", "ses:ListEmailIdentities", "signer:ListSigningProfiles", "sns:ListTopics", "sqs:ListQueues", "ssm-incidents:ListResponsePlans", "ssm:DescribeAutomationExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeMaintenanceWindows", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "states:ListActivities", "states:ListStateMachines", "storagegateway:ListGateways", "synthetics:ListGroups", "timestream:ListDatabases", "timestream:ListScheduledQueries", "transfer:ListAgreements", "transfer:ListCertificates", "transfer:ListConnectors", "transfer:ListProfiles", "transfer:ListServers", "transfer:ListWorkflows", "wisdom:ListAssistants", "wisdom:listAssistantAssociations", "wisdom:listKnowledgeBases", "workspaces:DescribeConnectionAliases", "workspaces:DescribeWorkspaces" ], "Resource": "*" } ] } } }, "createdDate": "2022-10-25T20:35:29.000Z", "lastUpdatedDate": "2025-03-25T14:22:06.000Z" }, "AWSFaultInjectionSimulatorSSMAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorSSMAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-10-26T15:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/*:*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-execution/*" ] } ] } }, "v2": { "createdDate": "2023-06-02T22:55:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/*:*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-execution/*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:CancelCommand" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-26T15:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/*:*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-execution/*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:CancelCommand" ], "Resource": "*" } ] } } }, "createdDate": "2022-10-26T15:33:44.000Z", "lastUpdatedDate": "2025-03-18T15:07:07.000Z" }, "AWSFaultInjectionSimulatorRDSAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorRDSAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-10-26T20:30:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:FailoverDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Effect": "Allow", "Action": [ "rds:RebootDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] } ] } }, "v2": { "createdDate": "2022-10-26T20:30:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFailover", "Effect": "Allow", "Action": [ "rds:FailoverDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "AllowReboot", "Effect": "Allow", "Action": [ "rds:RebootDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "DescribeResources", "Effect": "Allow", "Action": [ "rds:DescribeDBClusters", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-26T20:30:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFailover", "Effect": "Allow", "Action": [ "rds:FailoverDBCluster" ], "Resource": [ "arn:aws:rds:*:*:cluster:*" ] }, { "Sid": "AllowReboot", "Effect": "Allow", "Action": [ "rds:RebootDBInstance" ], "Resource": [ "arn:aws:rds:*:*:db:*" ] }, { "Sid": "DescribeResources", "Effect": "Allow", "Action": [ "rds:DescribeDBClusters", "rds:DescribeDBInstances" ], "Resource": "*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } } }, "createdDate": "2022-10-26T20:30:57.000Z", "lastUpdatedDate": "2025-03-18T15:07:06.000Z" }, "AWSFaultInjectionSimulatorNetworkAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorNetworkAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-10-26T20:32:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl", "aws:RequestTag/managedByFIS": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": [ "arn:aws:ec2:*:*:network-acl/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeManagedPrefixLists", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:ReplaceNetworkAclAssociation", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-acl/*" ] }, { "Effect": "Allow", "Action": "ec2:GetManagedPrefixListEntries", "Resource": "arn:aws:ec2:*:*:prefix-list/*" } ] } }, "v2": { "createdDate": "2022-10-26T20:32:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTagsOnNetworkAcl", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkAcl", "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteNetworkAcl", "Effect": "Allow", "Action": [ "ec2:CreateNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": [ "arn:aws:ec2:*:*:network-acl/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkAclOnVpc", "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "VpcActions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeManagedPrefixLists", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeVpcEndpoints", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeRouteTables", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGateways" ], "Resource": "*" }, { "Sid": "ReplaceNetworkAclAssociation", "Effect": "Allow", "Action": "ec2:ReplaceNetworkAclAssociation", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-acl/*" ] }, { "Sid": "GetManagedPrefixListEntries", "Effect": "Allow", "Action": "ec2:GetManagedPrefixListEntries", "Resource": "arn:aws:ec2:*:*:prefix-list/*" }, { "Sid": "CreateRouteTable", "Effect": "Allow", "Action": "ec2:CreateRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateRouteTableOnVpc", "Effect": "Allow", "Action": "ec2:CreateRouteTable", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "CreateTagsOnRouteTable", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateTagsOnNetworkInterface", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateTagsOnPrefixList", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateManagedPrefixList", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteRouteTable", "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": [ "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateRoute", "Effect": "Allow", "Action": "ec2:CreateRoute", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkInterface", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkInterfaceOnSubnet", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "DeleteNetworkInterface", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateManagedPrefixList", "Effect": "Allow", "Action": "ec2:CreateManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteManagedPrefixList", "Effect": "Allow", "Action": "ec2:DeleteManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ModifyManagedPrefixList", "Effect": "Allow", "Action": "ec2:ModifyManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ReplaceRouteTableAssociation", "Effect": "Allow", "Action": "ec2:ReplaceRouteTableAssociation", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "AssociateRouteTable", "Effect": "Allow", "Action": "ec2:AssociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "DisassociateRouteTable", "Effect": "Allow", "Action": "ec2:DisassociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "DisassociateRouteTableOnSubnet", "Effect": "Allow", "Action": "ec2:DisassociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "ModifyVpcEndpointOnRouteTable", "Effect": "Allow", "Action": "ec2:ModifyVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ModifyVpcEndpoint", "Effect": "Allow", "Action": "ec2:ModifyVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ] }, { "Sid": "TransitGatewayRouteTableAssociation", "Effect": "Allow", "Action": [ "ec2:DisassociateTransitGatewayRouteTable", "ec2:AssociateTransitGatewayRouteTable" ], "Resource": [ "arn:aws:ec2:*:*:transit-gateway-route-table/*", "arn:aws:ec2:*:*:transit-gateway-attachment/*" ] } ] } }, "v3": { "createdDate": "2022-10-26T20:32:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTagsOnNetworkAcl", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkAcl", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkAcl", "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:network-acl/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteNetworkAcl", "Effect": "Allow", "Action": [ "ec2:CreateNetworkAclEntry", "ec2:DeleteNetworkAcl" ], "Resource": [ "arn:aws:ec2:*:*:network-acl/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkAclOnVpc", "Effect": "Allow", "Action": "ec2:CreateNetworkAcl", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "VpcActions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeManagedPrefixLists", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeVpcEndpoints", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeRouteTables", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGateways" ], "Resource": "*" }, { "Sid": "ReplaceNetworkAclAssociation", "Effect": "Allow", "Action": "ec2:ReplaceNetworkAclAssociation", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-acl/*" ] }, { "Sid": "GetManagedPrefixListEntries", "Effect": "Allow", "Action": "ec2:GetManagedPrefixListEntries", "Resource": "arn:aws:ec2:*:*:prefix-list/*" }, { "Sid": "CreateRouteTable", "Effect": "Allow", "Action": "ec2:CreateRouteTable", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateRouteTableOnVpc", "Effect": "Allow", "Action": "ec2:CreateRouteTable", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "CreateTagsOnRouteTable", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateRouteTable", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateTagsOnNetworkInterface", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateTagsOnPrefixList", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateManagedPrefixList", "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteRouteTable", "Effect": "Allow", "Action": "ec2:DeleteRouteTable", "Resource": [ "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateRoute", "Effect": "Allow", "Action": "ec2:CreateRoute", "Resource": "arn:aws:ec2:*:*:route-table/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkInterface", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "CreateNetworkInterfaceOnSubnet", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "DeleteNetworkInterface", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "CreateManagedPrefixList", "Effect": "Allow", "Action": "ec2:CreateManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "aws:RequestTag/managedByFIS": "true" } } }, { "Sid": "DeleteManagedPrefixList", "Effect": "Allow", "Action": "ec2:DeleteManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ModifyManagedPrefixList", "Effect": "Allow", "Action": "ec2:ModifyManagedPrefixList", "Resource": "arn:aws:ec2:*:*:prefix-list/*", "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ReplaceRouteTableAssociation", "Effect": "Allow", "Action": "ec2:ReplaceRouteTableAssociation", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "AssociateRouteTable", "Effect": "Allow", "Action": "ec2:AssociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "DisassociateRouteTable", "Effect": "Allow", "Action": "ec2:DisassociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "DisassociateRouteTableOnSubnet", "Effect": "Allow", "Action": "ec2:DisassociateRouteTable", "Resource": [ "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "ModifyVpcEndpointOnRouteTable", "Effect": "Allow", "Action": "ec2:ModifyVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:route-table/*" ], "Condition": { "StringEquals": { "ec2:ResourceTag/managedByFIS": "true" } } }, { "Sid": "ModifyVpcEndpoint", "Effect": "Allow", "Action": "ec2:ModifyVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ] }, { "Sid": "TransitGatewayRouteTableAssociation", "Effect": "Allow", "Action": [ "ec2:DisassociateTransitGatewayRouteTable", "ec2:AssociateTransitGatewayRouteTable" ], "Resource": [ "arn:aws:ec2:*:*:transit-gateway-route-table/*", "arn:aws:ec2:*:*:transit-gateway-attachment/*" ] } ] } } }, "createdDate": "2022-10-26T20:32:50.000Z", "lastUpdatedDate": "2025-03-11T13:52:06.000Z" }, "AWSFaultInjectionSimulatorEKSAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorEKSAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-10-26T20:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "arn:aws:ec2:*:*:instance/*" } ] } }, "v2": { "createdDate": "2023-06-01T10:59:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": "ec2:DescribeSubnets", "Resource": "*" }, { "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "arn:aws:eks:*:*:cluster/*" } ] } }, "v3": { "createdDate": "2022-10-26T20:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstances", "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" }, { "Sid": "TerminateInstances", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "DescribeSubnets", "Effect": "Allow", "Action": "ec2:DescribeSubnets", "Resource": "*" }, { "Sid": "DescribeCluster", "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "arn:aws:eks:*:*:cluster/*" }, { "Sid": "DescribeNodeGroup", "Effect": "Allow", "Action": "eks:DescribeNodegroup", "Resource": "arn:aws:eks:*:*:nodegroup/*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-10-26T20:34:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstances", "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" }, { "Sid": "TerminateInstances", "Effect": "Allow", "Action": "ec2:TerminateInstances", "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "DescribeSubnets", "Effect": "Allow", "Action": "ec2:DescribeSubnets", "Resource": "*" }, { "Sid": "DescribeCluster", "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "arn:aws:eks:*:*:cluster/*" }, { "Sid": "DescribeNodeGroup", "Effect": "Allow", "Action": "eks:DescribeNodegroup", "Resource": "arn:aws:eks:*:*:nodegroup/*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } } }, "createdDate": "2022-10-26T20:34:43.000Z", "lastUpdatedDate": "2025-03-11T14:07:07.000Z" }, "AWSFaultInjectionSimulatorECSAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorECSAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-10-26T20:37:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:ListContainerInstances" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeTasks", "ecs:StopTask" ], "Resource": [ "arn:aws:ecs:*:*:task/*/*" ] }, { "Effect": "Allow", "Action": [ "ecs:ListTasks", "ecs:UpdateContainerInstancesState" ], "Resource": [ "arn:aws:ecs:*:*:container-instance/*/*" ] } ] } }, "v2": { "createdDate": "2023-06-01T10:48:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:ListContainerInstances" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Effect": "Allow", "Action": [ "ecs:DescribeTasks", "ecs:StopTask" ], "Resource": [ "arn:aws:ecs:*:*:task/*/*" ] }, { "Effect": "Allow", "Action": [ "ecs:ListTasks", "ecs:UpdateContainerInstancesState" ], "Resource": [ "arn:aws:ecs:*:*:container-instance/*/*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:CancelCommand" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-26T20:37:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Clusters", "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:ListContainerInstances" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Sid": "Tasks", "Effect": "Allow", "Action": [ "ecs:DescribeTasks", "ecs:StopTask" ], "Resource": [ "arn:aws:ecs:*:*:task/*/*" ] }, { "Sid": "ContainerInstances", "Effect": "Allow", "Action": [ "ecs:UpdateContainerInstancesState" ], "Resource": [ "arn:aws:ecs:*:*:container-instance/*/*" ] }, { "Sid": "ListTasks", "Effect": "Allow", "Action": [ "ecs:ListTasks" ], "Resource": "*" }, { "Sid": "SSMSend", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "SSMList", "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:CancelCommand" ], "Resource": "*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-10-26T20:37:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Clusters", "Effect": "Allow", "Action": [ "ecs:DescribeClusters", "ecs:ListContainerInstances" ], "Resource": [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Sid": "Tasks", "Effect": "Allow", "Action": [ "ecs:DescribeTasks", "ecs:StopTask" ], "Resource": [ "arn:aws:ecs:*:*:task/*/*" ] }, { "Sid": "ContainerInstances", "Effect": "Allow", "Action": [ "ecs:UpdateContainerInstancesState" ], "Resource": [ "arn:aws:ecs:*:*:container-instance/*/*" ] }, { "Sid": "ListTasks", "Effect": "Allow", "Action": [ "ecs:ListTasks" ], "Resource": "*" }, { "Sid": "SSMSend", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "SSMList", "Effect": "Allow", "Action": [ "ssm:ListCommands", "ssm:CancelCommand" ], "Resource": "*" }, { "Sid": "TargetResolutionByTags", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" } ] } } }, "createdDate": "2022-10-26T20:37:56.000Z", "lastUpdatedDate": "2025-03-07T14:52:07.000Z" }, "AWSFaultInjectionSimulatorEC2Access": { "arn": "arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorEC2Access", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2023-06-02T23:01:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:SendSpotInstanceInterruptions", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:ListCommands" ], "Resource": "*" } ] } }, "v1": { "createdDate": "2022-10-26T20:39:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:SendSpotInstanceInterruptions", "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ] }, { "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:ListCommands" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-10-26T20:39:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEc2Actions", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:SendSpotInstanceInterruptions", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:DescribeInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "AllowEc2InstancesWithEncryptedEbsVolumes", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "AllowSSMSendOnEc2", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "AllowSSMStopOnEc2", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:ListCommands" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2022-10-26T20:39:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEc2Actions", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:SendSpotInstanceInterruptions", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "AllowEc2InstancesWithEncryptedEbsVolumes", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "AllowSSMSendOnEc2", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "AllowSSMStopOnEc2", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:ListCommands" ], "Resource": "*" }, { "Sid": "DescribeInstances", "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" } ] } }, "v5": { "createdDate": "2022-10-26T20:39:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEc2Actions", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:SendSpotInstanceInterruptions", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "AllowEc2InstancesWithEncryptedEbsVolumes", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } } }, { "Sid": "AllowSSMSendOnEc2", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "AllowSSMStopOnEc2", "Effect": "Allow", "Action": [ "ssm:CancelCommand", "ssm:ListCommands" ], "Resource": "*" }, { "Sid": "DescribeInstances", "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" } ] } } }, "createdDate": "2022-10-26T20:39:26.000Z", "lastUpdatedDate": "2025-02-12T10:07:06.000Z" }, "AWSResourceExplorerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-07T19:56:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "resource-explorer-2:Get*", "resource-explorer-2:List*", "resource-explorer-2:Search", "resource-explorer-2:BatchGetView", "ec2:DescribeRegions", "ram:ListResources" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-07T19:56:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ResourceExplorerReadOnlyAccess", "Effect": "Allow", "Action": [ "resource-explorer-2:Get*", "resource-explorer-2:List*", "resource-explorer-2:Search", "resource-explorer-2:BatchGetView", "ec2:DescribeRegions", "ram:ListResources", "ram:GetResourceShares", "organizations:DescribeOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-07T19:56:00.000Z", "lastUpdatedDate": "2023-11-14T16:43:41.000Z" }, "AWSResourceExplorerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceExplorerFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-07T20:01:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "resource-explorer-2:*", "ec2:DescribeRegions", "ram:ListResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "resource-explorer-2.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2022-11-07T20:01:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ResourceExplorerConsoleFullAccess", "Effect": "Allow", "Action": [ "resource-explorer-2:*", "ec2:DescribeRegions", "ram:ListResources", "ram:GetResourceShares", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "ResourceExplorerSLRAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "resource-explorer-2.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-11-07T20:01:20.000Z", "lastUpdatedDate": "2023-11-14T16:53:46.000Z" }, "AmazonWorkspacesPCAAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkspacesPCAAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-08T00:25:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate", "acm-pca:GetCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "arn:*:acm-pca:*:*:*", "Condition": { "StringLike": { "aws:ResourceTag/euc-private-ca": "*" } } } ] } } }, "createdDate": "2022-11-08T00:25:55.000Z", "lastUpdatedDate": "2022-11-08T00:25:55.000Z" }, "AmazonGrafanaServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonGrafanaServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-08T23:10:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonGrafanaManaged" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "Null": { "aws:RequestTag/AmazonGrafanaManaged": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AmazonGrafanaManaged": "false" } } } ] } } }, "createdDate": "2022-11-08T23:10:33.000Z", "lastUpdatedDate": "2022-11-08T23:10:33.000Z" }, "AWSProtonCodeBuildProvisioningBasicAccess": { "arn": "arn:aws:iam::aws:policy/AWSProtonCodeBuildProvisioningBasicAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-09T21:04:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/codebuild/AWSProton-*" ] }, { "Effect": "Allow", "Action": "proton:NotifyResourceDeploymentStatusChange", "Resource": "arn:aws:proton:*:*:*" } ] } } }, "createdDate": "2022-11-09T21:04:16.000Z", "lastUpdatedDate": "2022-11-09T21:04:16.000Z" }, "AWSProtonCodeBuildProvisioningServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSProtonCodeBuildProvisioningServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-09T21:32:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:ListStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSProton-CodeBuild-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:RetryBuild", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects" ], "Resource": "arn:aws:codebuild:*:*:project/AWSProton*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "codebuild.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-05-17T16:11:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:ListStackResources" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/AWSProton-CodeBuild-*" ] }, { "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject", "codebuild:StartBuild", "codebuild:StopBuild", "codebuild:RetryBuild", "codebuild:BatchGetBuilds", "codebuild:BatchGetProjects" ], "Resource": "arn:aws:codebuild:*:*:project/AWSProton*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": "codebuild.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "servicequotas:GetServiceQuota" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-09T21:32:06.000Z", "lastUpdatedDate": "2023-05-17T16:11:40.000Z" }, "AmazonEventBridgeSchedulerFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeSchedulerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-10T18:37:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "scheduler:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "scheduler.amazonaws.com" } } } ] } } }, "createdDate": "2022-11-10T18:37:25.000Z", "lastUpdatedDate": "2022-11-10T18:37:25.000Z" }, "AmazonEventBridgeSchedulerReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgeSchedulerReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-10T18:50:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "scheduler:ListSchedules", "scheduler:ListScheduleGroups", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-10T18:50:12.000Z", "lastUpdatedDate": "2022-11-10T18:50:12.000Z" }, "AWSBackupRestoreAccessForSAPHANA": { "arn": "arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-10T22:43:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:Get*", "backup:List*", "backup:Describe*", "backup:StartBackupJob", "backup:StartRestoreJob" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:GetOperation", "ssm-sap:ListDatabases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm-sap:BackupDatabase", "ssm-sap:RestoreDatabase", "ssm-sap:UpdateHanaBackupSettings", "ssm-sap:GetDatabase", "ssm-sap:ListTagsForResource" ], "Resource": "arn:aws:ssm-sap:*:*:*" } ] } } }, "createdDate": "2022-11-10T22:43:27.000Z", "lastUpdatedDate": "2022-11-10T22:43:27.000Z" }, "AWSBackupDataTransferAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupDataTransferAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-10T22:48:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:StartObject", "backup-storage:PutChunk", "backup-storage:GetChunk", "backup-storage:ListChunks", "backup-storage:ListObjects", "backup-storage:GetObjectMetadata", "backup-storage:NotifyObjectComplete" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-10T22:48:05.000Z", "lastUpdatedDate": "2022-11-10T22:48:05.000Z" }, "AWSServiceCatalogSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceCatalogSyncServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-15T21:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ArtifactSyncToServiceCatalog", "Effect": "Allow", "Action": [ "servicecatalog:ListProvisioningArtifacts", "servicecatalog:DescribeProductAsAdmin", "servicecatalog:DeleteProvisioningArtifact", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:DescribeProvisioningArtifact", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:UpdateProvisioningArtifact" ], "Resource": "*" }, { "Sid": "AccessArtifactRepositories", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "ValidateTemplate", "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2022-11-15T21:20:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ArtifactSyncToServiceCatalog", "Effect": "Allow", "Action": [ "servicecatalog:ListProvisioningArtifacts", "servicecatalog:DescribeProductAsAdmin", "servicecatalog:DeleteProvisioningArtifact", "servicecatalog:ListServiceActionsForProvisioningArtifact", "servicecatalog:DescribeProvisioningArtifact", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:UpdateProvisioningArtifact" ], "Resource": "*" }, { "Sid": "AccessArtifactRepositories", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "ValidateTemplate", "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-15T21:20:15.000Z", "lastUpdatedDate": "2024-05-03T17:12:41.000Z" }, "AWSSSMForSAPServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSSMForSAPServiceLinkedRolePolicy", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:*:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": [ "True" ] } } }, { "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-01-06T02:41:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:*:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": [ "True" ] } } }, { "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } } ] } }, "v3": { "createdDate": "2023-07-31T22:33:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": [ "arn:*:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": [ "True" ] } } }, { "Effect": "Allow", "Action": [ "servicecatalog:GetApplication" ], "Resource": "arn:*:servicecatalog:*:*:*" }, { "Effect": "Allow", "Action": "servicecatalog:DeleteApplication", "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } } ] } }, "v4": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "DeleteApplication", "Effect": "Allow", "Action": "servicecatalog:DeleteApplication", "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } } ] } }, "v5": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } } ] } }, "v6": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "TagAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "GetAppTagResourceGroupConfig", "Effect": "Allow", "Action": [ "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*" ] } ] } }, "v7": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:*:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "TagAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "GetAppTagResourceGroupConfig", "Effect": "Allow", "Action": [ "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*" ] }, { "Sid": "StartStopInstances", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ec2:resourceTag/SSMForSAPManaged": "True" } } } ] } }, "v8": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "TagAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "GetAppTagResourceGroupConfig", "Effect": "Allow", "Action": [ "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*" ] }, { "Sid": "StartStopInstances", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ec2:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "SsmSapResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag", "resource-groups:CreateGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" }, "ArnLike": { "aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated", "awsApplication" ] } } }, { "Sid": "ManageSsmSapTagsOnEc2Instances", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPManaged": "True" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } }, { "Sid": "ManageSsmSapTagsOnEbsVolumes", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } } ] } }, "v9": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "TagAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "GetAppTagResourceGroupConfig", "Effect": "Allow", "Action": [ "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*" ] }, { "Sid": "StartStopInstances", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ec2:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "SsmSapResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag", "resource-groups:CreateGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" }, "ArnLike": { "aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated", "awsApplication" ] } } }, { "Sid": "ManageSsmSapTagsOnEc2Instances", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPManaged": "True" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } }, { "Sid": "ManageSsmSapTagsOnEbsVolumes", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } }, { "Sid": "ManageAppTagsOnEbsVolumes", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "awsApplication" ] } } } ] } }, "v10": { "createdDate": "2022-11-16T01:18:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeInstanceTypes", "ec2:DescribeVolumes", "ec2:DescribeInstanceAttribute", "ec2:DescribeSnapshots", "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "DescribeInstanceStatus", "Effect": "Allow", "Action": "ec2:DescribeInstanceStatus", "Resource": "*" }, { "Sid": "TargetRuleActions", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:DescribeRule", "events:PutRule", "events:RemoveTargets" ], "Resource": [ "arn:*:events:*:*:rule/SSMSAPManagedRule*", "arn:*:events:*:*:event-bus/default" ] }, { "Sid": "DocumentActions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:SendCommand" ], "Resource": [ "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", "arn:*:ssm:*:*:document/AWSSSMSAP*", "arn:*:ssm:*:*:document/AWSSAP*" ] }, { "Sid": "CustomerSendCommand", "Effect": "Allow", "Action": "ssm:SendCommand", "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ssm:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "InstanceTagActions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/awsApplication": "false" }, "StringEqualsIgnoreCase": { "ec2:ResourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "DescribeTag", "Effect": "Allow", "Action": "ec2:DescribeTags", "Resource": "*" }, { "Sid": "GetApplication", "Effect": "Allow", "Action": "servicecatalog:GetApplication", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "UpdateOrDeleteApplication", "Effect": "Allow", "Action": [ "servicecatalog:DeleteApplication", "servicecatalog:UpdateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateApplication", "Effect": "Allow", "Action": [ "servicecatalog:TagResource", "servicecatalog:CreateApplication" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", "Condition": { "StringEquals": { "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" } } }, { "Sid": "PutMetricData", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage", "AWS/SSMForSAP" ] } } }, { "Sid": "CreateAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:CreateAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" } } }, { "Sid": "GetAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:GetAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" }, { "Sid": "DeleteAttributeGroup", "Effect": "Allow", "Action": "servicecatalog:DeleteAttributeGroup", "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "AttributeGroupActions", "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": "arn:*:servicecatalog:*:*:*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "ListAssociatedAttributeGroups", "Effect": "Allow", "Action": "servicecatalog:ListAssociatedAttributeGroups", "Resource": "arn:*:servicecatalog:*:*:*" }, { "Sid": "CreateGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated" ] } } }, { "Sid": "GetGroup", "Effect": "Allow", "Action": "resource-groups:GetGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*" }, { "Sid": "DeleteGroup", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPCreated": "True" } } }, { "Sid": "CreateAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "TagAppTagResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag" ], "Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true" } } }, { "Sid": "GetAppTagResourceGroupConfig", "Effect": "Allow", "Action": [ "resource-groups:GetGroupConfiguration" ], "Resource": [ "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*" ] }, { "Sid": "StartStopInstances", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:*:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ec2:resourceTag/SSMForSAPManaged": "True" } } }, { "Sid": "SsmSapResourceGroup", "Effect": "Allow", "Action": [ "resource-groups:Tag", "resource-groups:CreateGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/SystemsManagerForSAP-*", "Condition": { "StringEquals": { "aws:RequestTag/SSMForSAPCreated": "True" }, "ArnLike": { "aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SSMForSAPCreated", "awsApplication" ] } } }, { "Sid": "ManageSsmSapTagsOnEc2Instances", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/SSMForSAPManaged": "True" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } }, { "Sid": "ManageSsmSapTagsOnEbsVolumes", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "SystemsManagerForSAP-*" ] } } }, { "Sid": "ManageAppTagsOnEbsVolumes", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "awsApplication" ] } } } ] } } }, "createdDate": "2022-11-16T01:18:21.000Z", "lastUpdatedDate": "2024-12-11T22:51:34.000Z" }, "AWSSystemsManagerForSAPFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSystemsManagerForSAPFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-11-17T02:11:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm-sap:*" ], "Resource": "arn:*:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm-sap.amazonaws.com/AWSServiceRoleForSSMForSAP" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm-sap.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2022-11-18T21:58:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm-sap:*" ], "Resource": "arn:*:ssm-sap:*:*:*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm-sap.amazonaws.com/AWSServiceRoleForAWSSSMForSAP" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm-sap.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2022-11-17T02:11:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsSsmForSapPermissions", "Effect": "Allow", "Action": [ "ssm-sap:*" ], "Resource": "arn:*:ssm-sap:*:*:*" }, { "Sid": "AwsSsmForSapServiceRoleCreationPermission", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm-sap.amazonaws.com/AWSServiceRoleForAWSSSMForSAP" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm-sap.amazonaws.com" } } }, { "Sid": "Ec2StartStopPermission", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEqualsIgnoreCase": { "ec2:resourceTag/SSMForSAPManaged": "True" } } } ] } } }, "createdDate": "2022-11-17T02:11:09.000Z", "lastUpdatedDate": "2024-07-10T21:54:54.000Z" }, "AWSSystemsManagerForSAPReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSystemsManagerForSAPReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-17T02:11:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm-sap:get*", "ssm-sap:list*" ], "Resource": "arn:*:ssm-sap:*:*:*" } ] } } }, "createdDate": "2022-11-17T02:11:44.000Z", "lastUpdatedDate": "2022-11-17T02:11:44.000Z" }, "AmazonOpenSearchIngestionServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchIngestionServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-18T16:49:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/OSISManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVpcEndpoints" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/OSISManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" } } }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/OSIS" } } } ] } } }, "createdDate": "2022-11-18T16:49:50.000Z", "lastUpdatedDate": "2022-11-18T16:49:50.000Z" }, "AWSReachabilityAnalyzerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSReachabilityAnalyzerServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2022-11-23T17:12:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "resource-groups:ListGroupResources", "tag:GetResources", "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v2": { "createdDate": "2023-06-23T21:04:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "tag:GetResources", "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v3": { "createdDate": "2022-11-23T17:12:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReachabilityAnalyzerPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "tag:GetResources", "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" }, { "Sid": "ApigatewayPermissions", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } }, "v4": { "createdDate": "2022-11-23T17:12:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReachabilityAnalyzerPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "resource-groups:ListGroups", "resource-groups:ListGroupResources", "tag:GetResources", "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" }, { "Sid": "ApigatewayPermissions", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } } }, "createdDate": "2022-11-23T17:12:28.000Z", "lastUpdatedDate": "2024-09-10T16:04:52.000Z" }, "AmazonOpenSearchServerlessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchServerlessServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-24T19:50:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AOSS" } } } ] } }, "v2": { "createdDate": "2022-11-24T19:50:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAOSSCloudwatchMetrics", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AOSS" } } } ] } } }, "createdDate": "2022-11-24T19:50:12.000Z", "lastUpdatedDate": "2024-07-25T21:19:30.000Z" }, "AWSApplicationMigrationSSMAccess": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationSSMAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-27T09:29:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } } ] } }, "v2": { "createdDate": "2023-03-20T10:57:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:DescribeDocument", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:document/*", "arn:aws:ssm:*:*:automation-definition/*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListDocuments" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListDocumentVersions", "ssm:GetDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" } ] } } }, "createdDate": "2022-11-27T09:29:05.000Z", "lastUpdatedDate": "2023-03-20T10:57:51.000Z" }, "OAMReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/OAMReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T13:29:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "oam:Get*", "oam:List*" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-27T13:29:39.000Z", "lastUpdatedDate": "2022-11-27T13:29:39.000Z" }, "OAMFullAccess": { "arn": "arn:aws:iam::aws:policy/OAMFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T13:38:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "oam:*" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-27T13:38:29.000Z", "lastUpdatedDate": "2022-11-27T13:38:29.000Z" }, "AWSXrayCrossAccountSharingConfiguration": { "arn": "arn:aws:iam::aws:policy/AWSXrayCrossAccountSharingConfiguration", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T13:46:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "xray:Link", "oam:ListLinks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:DeleteLink", "oam:GetLink", "oam:TagResource" ], "Resource": "arn:aws:oam:*:*:link/*" }, { "Effect": "Allow", "Action": [ "oam:CreateLink", "oam:UpdateLink" ], "Resource": [ "arn:aws:oam:*:*:link/*", "arn:aws:oam:*:*:sink/*" ] } ] } } }, "createdDate": "2022-11-27T13:46:35.000Z", "lastUpdatedDate": "2022-11-27T13:46:35.000Z" }, "CloudWatchLogsCrossAccountSharingConfiguration": { "arn": "arn:aws:iam::aws:policy/CloudWatchLogsCrossAccountSharingConfiguration", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T13:55:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:Link", "oam:ListLinks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:DeleteLink", "oam:GetLink", "oam:TagResource" ], "Resource": "arn:aws:oam:*:*:link/*" }, { "Effect": "Allow", "Action": [ "oam:CreateLink", "oam:UpdateLink" ], "Resource": [ "arn:aws:oam:*:*:link/*", "arn:aws:oam:*:*:sink/*" ] } ] } } }, "createdDate": "2022-11-27T13:55:22.000Z", "lastUpdatedDate": "2022-11-27T13:55:22.000Z" }, "CloudWatchCrossAccountSharingConfiguration": { "arn": "arn:aws:iam::aws:policy/CloudWatchCrossAccountSharingConfiguration", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T14:01:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:Link", "oam:ListLinks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:DeleteLink", "oam:GetLink", "oam:TagResource" ], "Resource": "arn:aws:oam:*:*:link/*" }, { "Effect": "Allow", "Action": [ "oam:CreateLink", "oam:UpdateLink" ], "Resource": [ "arn:aws:oam:*:*:link/*", "arn:aws:oam:*:*:sink/*" ] } ] } } }, "createdDate": "2022-11-27T14:01:10.000Z", "lastUpdatedDate": "2022-11-27T14:01:10.000Z" }, "CloudWatchInternetMonitorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchInternetMonitorServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-27T17:46:24.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "workspaces:DescribeWorkspaceDirectories", "cloudfront:GetDistribution" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/internet-monitor/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/internet-monitor/*:log-stream:*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/InternetMonitor" } }, "Resource": "*" } ], "Version": "2012-10-17" } }, "v2": { "createdDate": "2023-07-20T04:46:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudfront:GetDistribution", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:/aws/internet-monitor/*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/internet-monitor/*:log-stream:*" }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/InternetMonitor" } }, "Resource": "*" } ] } } }, "createdDate": "2022-11-27T17:46:24.000Z", "lastUpdatedDate": "2023-07-20T04:46:37.000Z" }, "AWSWickrFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSWickrFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-27T20:36:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "wickr:*", "Resource": "*" } ] } } }, "createdDate": "2022-11-27T20:36:44.000Z", "lastUpdatedDate": "2022-11-27T20:36:44.000Z" }, "AWSVPCVerifiedAccessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSVPCVerifiedAccessServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-11-29T03:35:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/VerifiedAccessManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/VerifiedAccessManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } } ] } }, "v2": { "createdDate": "2023-06-01T16:28:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/VerifiedAccessManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/VerifiedAccessManaged": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } } ] } }, "v3": { "createdDate": "2022-11-29T03:35:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VerifiedAccessRoleModifyTaggedNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/VerifiedAccessManaged": "true" } } }, { "Sid": "VerifiedAccessRoleModifyNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Sid": "VerifiedAccessRoleNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "VerifiedAccessRoleTaggedNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/VerifiedAccessManaged": "true" } } }, { "Sid": "VerifiedAccessRoleTaggingActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } } ] } } }, "createdDate": "2022-11-29T03:35:11.000Z", "lastUpdatedDate": "2023-11-17T21:03:13.000Z" }, "AmazonOmicsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOmicsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-29T04:17:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "omics:Get*", "omics:List*" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-29T04:17:07.000Z", "lastUpdatedDate": "2022-11-29T04:17:07.000Z" }, "SecurityLakeServiceLinkedRole": { "arn": "arn:aws:iam::aws:policy/aws-service-role/SecurityLakeServiceLinkedRole", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-11-29T14:03:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationsPolicies", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "DescribeOrgAccounts", "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": [ "arn:aws:organizations::*:account/o-*/*" ] }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/security-lake/*" }, { "Sid": "AllowListServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": "*" }, { "Sid": "DescribeAnyVpc", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "ListDelegatedAdmins", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securitylake.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2022-11-29T14:03:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationsPolicies", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "DescribeOrgAccounts", "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": [ "arn:aws:organizations::*:account/o-*/*" ] }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/security-lake/*" }, { "Sid": "AllowListServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": "*" }, { "Sid": "DescribeAnyVpc", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "ListDelegatedAdmins", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securitylake.amazonaws.com" } } }, { "Sid": "AllowWafLoggingConfiguration", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "wafv2:LogScope": "SecurityLake" } } }, { "Sid": "AllowPutLoggingConfiguration", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration" ], "Resource": "*", "Condition": { "ArnLike": { "wafv2:LogDestinationResource": "arn:aws:s3:::aws-waf-logs-security-lake-*" } } }, { "Sid": "ListWebACLs", "Effect": "Allow", "Action": [ "wafv2:ListWebACLs" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-29T14:03:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationsPolicies", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Sid": "DescribeOrgAccounts", "Effect": "Allow", "Action": [ "organizations:DescribeAccount" ], "Resource": [ "arn:aws:organizations::*:account/o-*/*" ] }, { "Sid": "AllowManagementOfServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel", "cloudtrail:GetServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel" ], "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/security-lake/*" }, { "Sid": "AllowListServiceLinkedChannel", "Effect": "Allow", "Action": [ "cloudtrail:ListServiceLinkedChannels" ], "Resource": "*" }, { "Sid": "DescribeAnyVpc", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "ListDelegatedAdmins", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "securitylake.amazonaws.com" } } }, { "Sid": "AllowWafLoggingConfiguration", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration", "wafv2:GetLoggingConfiguration", "wafv2:ListLoggingConfigurations", "wafv2:DeleteLoggingConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "wafv2:LogScope": "SecurityLake" } } }, { "Sid": "AllowPutLoggingConfiguration", "Effect": "Allow", "Action": [ "wafv2:PutLoggingConfiguration" ], "Resource": "*", "Condition": { "ArnLike": { "wafv2:LogDestinationResource": "arn:aws:s3:::aws-waf-logs-security-lake-*" } } }, { "Sid": "ListWebACLs", "Effect": "Allow", "Action": [ "wafv2:ListWebACLs" ], "Resource": "*" }, { "Sid": "LogDelivery", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "wafv2.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-11-29T14:03:33.000Z", "lastUpdatedDate": "2024-04-19T16:00:05.000Z" }, "AmazonSecurityLakePermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-29T14:11:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation", "kms:Decrypt", "kms:GenerateDataKey", "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Deny", "NotAction": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation", "kms:Decrypt", "kms:GenerateDataKey", "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation" ], "NotResource": [ "arn:aws:s3:::aws-security-data-lake*" ] }, { "Effect": "Deny", "Action": [ "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "NotResource": "arn:aws:sqs:*:*:AmazonSecurityLake*" }, { "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringNotLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com" ] } } }, { "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "Null": { "kms:EncryptionContext:aws:s3:arn": "false" }, "StringNotLikeIfExists": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::aws-security-data-lake*" ] } } }, { "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "Null": { "kms:EncryptionContext:aws:sqs:arn": "false" }, "StringNotLikeIfExists": { "kms:EncryptionContext:aws:sqs:arn": [ "arn:aws:sqs:*:*:AmazonSecurityLake*" ] } } } ] } }, "v2": { "createdDate": "2022-11-29T14:11:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowActionsForSecurityLake", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation", "kms:Decrypt", "kms:GenerateDataKey", "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" }, { "Sid": "DenyActionsForSecurityLake", "Effect": "Deny", "NotAction": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation", "kms:Decrypt", "kms:GenerateDataKey", "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "Resource": "*" }, { "Sid": "DenyActionsNotOnSecurityLakeBucket", "Effect": "Deny", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutObject", "s3:GetBucketLocation" ], "NotResource": [ "arn:aws:s3:::aws-security-data-lake*" ] }, { "Sid": "DenyActionsNotOnSecurityLakeSQS", "Effect": "Deny", "Action": [ "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:ListQueues" ], "NotResource": "arn:aws:sqs:*:*:AmazonSecurityLake*" }, { "Sid": "DenyActionsNotOnSecurityLakeKMSS3SQS", "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringNotLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com" ] } } }, { "Sid": "DenyActionsNotOnSecurityLakeKMSForS3", "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "Null": { "kms:EncryptionContext:aws:s3:arn": "false" }, "StringNotLikeIfExists": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::aws-security-data-lake*" ] } } }, { "Sid": "DenyActionsNotOnSecurityLakeKMSForS3SQS", "Effect": "Deny", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "Null": { "kms:EncryptionContext:aws:sqs:arn": "false" }, "StringNotLikeIfExists": { "kms:EncryptionContext:aws:sqs:arn": [ "arn:aws:sqs:*:*:AmazonSecurityLake*" ] } } } ] } } }, "createdDate": "2022-11-29T14:11:12.000Z", "lastUpdatedDate": "2024-05-14T20:39:20.000Z" }, "AmazonSageMakerModelGovernanceUseAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerModelGovernanceUseAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2022-11-30T08:58:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:ListMonitoringAlerts", "sagemaker:ListMonitoringExecutions", "sagemaker:UpdateMonitoringAlert", "sagemaker:StartMonitoringSchedule", "sagemaker:StopMonitoringSchedule", "sagemaker:ListMonitoringAlertHistory", "sagemaker:CreateModelCard", "sagemaker:DescribeModelCard", "sagemaker:UpdateModelCard", "sagemaker:DeleteModelCard", "sagemaker:ListModelCards", "sagemaker:ListModelCardVersions", "sagemaker:CreateModelCardExportJob", "sagemaker:DescribeModelCardExportJob", "sagemaker:ListModelCardExportJobs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListTrainingJobs", "sagemaker:DescribeTrainingJob", "sagemaker:ListModels", "sagemaker:DescribeModel", "sagemaker:Search", "sagemaker:AddTags", "sagemaker:DeleteTags", "sagemaker:ListTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:CreateBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-07-17T22:31:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:ListMonitoringAlerts", "sagemaker:ListMonitoringExecutions", "sagemaker:UpdateMonitoringAlert", "sagemaker:StartMonitoringSchedule", "sagemaker:StopMonitoringSchedule", "sagemaker:ListMonitoringAlertHistory", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:CreateModelCard", "sagemaker:DescribeModelCard", "sagemaker:UpdateModelCard", "sagemaker:DeleteModelCard", "sagemaker:ListModelCards", "sagemaker:ListModelCardVersions", "sagemaker:CreateModelCardExportJob", "sagemaker:DescribeModelCardExportJob", "sagemaker:ListModelCardExportJobs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:ListTrainingJobs", "sagemaker:DescribeTrainingJob", "sagemaker:ListModels", "sagemaker:DescribeModel", "sagemaker:Search", "sagemaker:AddTags", "sagemaker:DeleteTags", "sagemaker:ListTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:CreateBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2022-11-30T08:58:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSMMonitoringModelCards", "Effect": "Allow", "Action": [ "sagemaker:ListMonitoringAlerts", "sagemaker:ListMonitoringExecutions", "sagemaker:UpdateMonitoringAlert", "sagemaker:StartMonitoringSchedule", "sagemaker:StopMonitoringSchedule", "sagemaker:ListMonitoringAlertHistory", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:CreateModelCard", "sagemaker:DescribeModelCard", "sagemaker:UpdateModelCard", "sagemaker:DeleteModelCard", "sagemaker:ListModelCards", "sagemaker:ListModelCardVersions", "sagemaker:CreateModelCardExportJob", "sagemaker:DescribeModelCardExportJob", "sagemaker:ListModelCardExportJobs" ], "Resource": "*" }, { "Sid": "AllowSMTrainingModelsSearchTags", "Effect": "Allow", "Action": [ "sagemaker:ListTrainingJobs", "sagemaker:DescribeTrainingJob", "sagemaker:ListModels", "sagemaker:DescribeModel", "sagemaker:Search", "sagemaker:AddTags", "sagemaker:DeleteTags", "sagemaker:ListTags" ], "Resource": "*" }, { "Sid": "AllowKMSActions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Sid": "AllowS3Actions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:CreateBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AllowS3ListActions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-30T08:58:19.000Z", "lastUpdatedDate": "2024-06-04T21:48:12.000Z" }, "AmazonSageMakerGeospatialFullAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerGeospatialFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-30T10:06:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sagemaker-geospatial:*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker-geospatial.amazonaws.com" ] } } } ] } } }, "createdDate": "2022-11-30T10:06:48.000Z", "lastUpdatedDate": "2022-11-30T10:06:48.000Z" }, "AmazonSageMakerGeospatialExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerGeospatialExecutionRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-30T10:08:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": "sagemaker-geospatial:GetEarthObservationJob", "Resource": "arn:aws:sagemaker-geospatial:*:*:earth-observation-job/*" } ] } }, "v2": { "createdDate": "2023-05-10T20:28:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": "sagemaker-geospatial:GetEarthObservationJob", "Resource": "arn:aws:sagemaker-geospatial:*:*:earth-observation-job/*" }, { "Effect": "Allow", "Action": "sagemaker-geospatial:GetRasterDataCollection", "Resource": "arn:aws:sagemaker-geospatial:*:*:raster-data-collection/*" } ] } } }, "createdDate": "2022-11-30T10:08:36.000Z", "lastUpdatedDate": "2023-05-10T20:28:02.000Z" }, "AmazonDocDB-ElasticServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonDocDB-ElasticServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-11-30T14:17:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/DocDB-Elastic" ] } } } ] } } }, "createdDate": "2022-11-30T14:17:05.000Z", "lastUpdatedDate": "2022-11-30T14:17:05.000Z" }, "AWSVpcLatticeServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSVpcLatticeServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-11-30T20:47:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/VpcLattice" } } } ] } }, "v2": { "createdDate": "2022-11-30T20:47:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/VpcLattice" } } }, { "Sid": "VpcLatticeDescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "VpcLatticeCreateNetworkInterfaceWithTag", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:RequestTag/VpcLatticeManaged": "true" } } }, { "Sid": "VpcLatticeCreateNetworkInterfaceWithSubnetAndSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "VpcLatticeTagNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Sid": "VpcLatticeMutateNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/VpcLatticeManaged": "true" } } }, { "Sid": "VpcLatticeModifyNetworkInterfaceSecurityGroup", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Sid": "VpcLatticeModifyNetworkInterfaceActionsIpAddressActions", "Effect": "Allow", "Action": [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/VpcLatticeManaged": "true" } } }, { "Sid": "VpcLatticeAssociateHostedZoneToVpc", "Effect": "Allow", "Action": [ "route53:AssociateVPCWithHostedZone" ], "Resource": "*" } ] } } }, "createdDate": "2022-11-30T20:47:10.000Z", "lastUpdatedDate": "2024-12-01T14:06:06.000Z" }, "AmazonEventBridgePipesFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgePipesFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-01T17:03:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EventBridgePipesActions", "Effect": "Allow", "Action": "pipes:*", "Resource": "*" }, { "Sid": "IAMPassRoleAccessForPipes", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringLike": { "iam:PassedToService": "pipes.amazonaws.com" } } } ] } } }, "createdDate": "2022-12-01T17:03:20.000Z", "lastUpdatedDate": "2022-12-01T17:03:20.000Z" }, "AmazonEventBridgePipesReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgePipesReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-01T17:04:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2022-12-01T17:04:03.000Z", "lastUpdatedDate": "2022-12-01T17:04:03.000Z" }, "AmazonEventBridgePipesOperatorAccess": { "arn": "arn:aws:iam::aws:policy/AmazonEventBridgePipesOperatorAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-01T17:04:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "pipes:DescribePipe", "pipes:ListPipes", "pipes:ListTagsForResource", "pipes:StartPipe", "pipes:StopPipe" ], "Resource": "*" } ] } } }, "createdDate": "2022-12-01T17:04:32.000Z", "lastUpdatedDate": "2022-12-01T17:04:32.000Z" }, "AWSServiceRoleForGroundStationDataflowEndpointGroupPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForGroundStationDataflowEndpointGroupPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-13T23:52:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeAddresses", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" } ] } } }, "createdDate": "2022-12-13T23:52:45.000Z", "lastUpdatedDate": "2022-12-13T23:52:45.000Z" }, "AWSBackupGatewayServiceRolePolicyForVirtualMachineMetadataSync": { "arn": "arn:aws:iam::aws:policy/service-role/AWSBackupGatewayServiceRolePolicyForVirtualMachineMetadataSync", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-15T19:43:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListVmTags", "Effect": "Allow", "Action": [ "backup-gateway:ListTagsForResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" }, { "Sid": "VMTagPermissions", "Effect": "Allow", "Action": [ "backup-gateway:TagResource", "backup-gateway:UntagResource" ], "Resource": "arn:aws:backup-gateway:*:*:vm/*" } ] } } }, "createdDate": "2022-12-15T19:43:11.000Z", "lastUpdatedDate": "2022-12-15T19:43:11.000Z" }, "AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2022-12-19T23:11:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:UpdateTermination*", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:GetTemplateSummary", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/ams-detective-controls-config-recorder", "arn:aws:cloudformation:*:*:stack/ams-detective-controls-config-rules-cdk", "arn:aws:cloudformation:*:*:stack/ams-detective-controls-infrastructure-cdk" ] }, { "Effect": "Allow", "Action": [ "config:DescribeAggregationAuthorizations", "config:PutAggregationAuthorization", "config:TagResource", "config:PutConfigRule" ], "Resource": [ "arn:aws:config:*:*:aggregation-authorization/540708452589/*", "arn:aws:config:*:*::config-rule/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketPolicy", "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:GetBucketAcl", "s3:PutObject", "s3:PutBucketAcl", "s3:PutBucketLogging", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutEncryptionConfiguration" ], "Resource": "arn:aws:s3:::ams-config-record-bucket-*" } ] } } }, "createdDate": "2022-12-19T23:11:17.000Z", "lastUpdatedDate": "2022-12-19T23:11:17.000Z" }, "AWSLicenseManagerLinuxSubscriptionsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerLinuxSubscriptionsServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2022-12-20T18:54:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2022-12-20T18:54:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": [ "*" ] }, { "Sid": "OrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:DescribeAccount", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": [ "*" ] }, { "Sid": "SecretsManagerPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Condition": { "StringEquals": { "aws:ResourceTag/LicenseManagerLinuxSubscriptions": "enabled", "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": [ "arn:aws:secretsmanager:*:*:secret:*" ] }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Condition": { "StringEquals": { "aws:ResourceTag/LicenseManagerLinuxSubscriptions": "enabled", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] } }, "Resource": [ "arn:aws:kms:*:*:key/*" ] } ] } } }, "createdDate": "2022-12-20T18:54:54.000Z", "lastUpdatedDate": "2024-07-08T22:04:56.000Z" }, "AWSOutpostsAuthorizeServerPolicy": { "arn": "arn:aws:iam::aws:policy/AWSOutpostsAuthorizeServerPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-04T19:23:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "outposts:StartConnection", "outposts:GetConnection" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-04T19:23:22.000Z", "lastUpdatedDate": "2023-01-04T19:23:22.000Z" }, "AWSElasticDisasterRecoveryStagingAccountPolicy_v2": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryStagingAccountPolicy_v2", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-01-05T12:11:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "drs:DescribeSourceServers", "drs:DescribeRecoverySnapshots", "drs:CreateConvertedSnapshotForDrs", "drs:GetReplicationConfiguration", "drs:DescribeJobs", "drs:DescribeJobLogItems" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/userId": "${aws:SourceIdentity}" }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": [ "arn:aws:drs:*:*:source-server/*" ] } ] } }, "v2": { "createdDate": "2023-01-05T12:11:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSStagingAccountPolicyv21", "Effect": "Allow", "Action": [ "drs:DescribeSourceServers", "drs:DescribeRecoverySnapshots", "drs:CreateConvertedSnapshotForDrs", "drs:GetReplicationConfiguration", "drs:DescribeJobs", "drs:DescribeJobLogItems" ], "Resource": "*" }, { "Sid": "DRSStagingAccountPolicyv22", "Effect": "Allow", "Action": [ "ec2:ModifySnapshotAttribute" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "ec2:Add/userId": "${aws:SourceIdentity}" }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "DRSStagingAccountPolicyv23", "Effect": "Allow", "Action": "drs:IssueAgentCertificateForDrs", "Resource": [ "arn:aws:drs:*:*:source-server/*" ] } ] } } }, "createdDate": "2023-01-05T12:11:44.000Z", "lastUpdatedDate": "2023-11-27T13:32:09.000Z" }, "ResourceGroupsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ResourceGroupsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-05T16:57:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:GetResources", "cloudformation:DescribeStacks", "cloudformation:ListStackResources" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-05T16:57:08.000Z", "lastUpdatedDate": "2023-01-05T16:57:08.000Z" }, "AWSCleanRoomsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-12T16:10:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsRead", "Effect": "Allow", "Action": [ "cleanrooms:BatchGet*", "cleanrooms:Get*", "cleanrooms:List*" ], "Resource": "*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-12T16:10:48.000Z", "lastUpdatedDate": "2023-01-12T16:10:48.000Z" }, "AWSCleanRoomsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCleanRoomsFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-01-12T16:10:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:*" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "ConsolePickQueryResultsBucketListAll", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsolePickQueryResultsBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*" }, { "Sid": "WriteQueryResults", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleDisplayQueryResults", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-01-12T16:10:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:*" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "ConsolePickQueryResultsBucketListAll", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "SetQueryResultsBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*" }, { "Sid": "WriteQueryResults", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleDisplayQueryResults", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::cleanrooms-queryresults*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-12T16:10:54.000Z", "lastUpdatedDate": "2024-03-21T15:35:13.000Z" }, "AWSCleanRoomsFullAccessNoQuerying": { "arn": "arn:aws:iam::aws:policy/AWSCleanRoomsFullAccessNoQuerying", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-01-12T16:12:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:BatchGetSchema", "cleanrooms:CreateCollaboration", "cleanrooms:CreateConfiguredTable", "cleanrooms:CreateConfiguredTableAnalysisRule", "cleanrooms:CreateConfiguredTableAssociation", "cleanrooms:CreateMembership", "cleanrooms:DeleteCollaboration", "cleanrooms:DeleteConfiguredTable", "cleanrooms:DeleteConfiguredTableAnalysisRule", "cleanrooms:DeleteConfiguredTableAssociation", "cleanrooms:DeleteMember", "cleanrooms:DeleteMembership", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:UpdateCollaboration", "cleanrooms:UpdateConfiguredTable", "cleanrooms:UpdateConfiguredTableAnalysisRule", "cleanrooms:UpdateConfiguredTableAssociation", "cleanrooms:UpdateMembership" ], "Resource": "*" }, { "Sid": "CleanRoomsNoQuerying", "Effect": "Deny", "Action": [ "cleanrooms:StartProtectedQuery", "cleanrooms:UpdateProtectedQuery" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-03-21T16:47:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:BatchGetSchema", "cleanrooms:CreateCollaboration", "cleanrooms:CreateConfiguredTable", "cleanrooms:CreateConfiguredTableAnalysisRule", "cleanrooms:CreateConfiguredTableAssociation", "cleanrooms:CreateMembership", "cleanrooms:DeleteCollaboration", "cleanrooms:DeleteConfiguredTable", "cleanrooms:DeleteConfiguredTableAnalysisRule", "cleanrooms:DeleteConfiguredTableAssociation", "cleanrooms:DeleteMember", "cleanrooms:DeleteMembership", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:UpdateCollaboration", "cleanrooms:UpdateConfiguredTable", "cleanrooms:UpdateConfiguredTableAnalysisRule", "cleanrooms:UpdateConfiguredTableAssociation", "cleanrooms:UpdateMembership", "cleanrooms:ListTagsForResource", "cleanrooms:UntagResource", "cleanrooms:TagResource" ], "Resource": "*" }, { "Sid": "CleanRoomsNoQuerying", "Effect": "Deny", "Action": [ "cleanrooms:StartProtectedQuery", "cleanrooms:UpdateProtectedQuery" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-07-31T20:03:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:CreateAnalysisTemplate", "cleanrooms:CreateCollaboration", "cleanrooms:CreateConfiguredTable", "cleanrooms:CreateConfiguredTableAnalysisRule", "cleanrooms:CreateConfiguredTableAssociation", "cleanrooms:CreateMembership", "cleanrooms:DeleteAnalysisTemplate", "cleanrooms:DeleteCollaboration", "cleanrooms:DeleteConfiguredTable", "cleanrooms:DeleteConfiguredTableAnalysisRule", "cleanrooms:DeleteConfiguredTableAssociation", "cleanrooms:DeleteMember", "cleanrooms:DeleteMembership", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:UpdateAnalysisTemplate", "cleanrooms:UpdateCollaboration", "cleanrooms:UpdateConfiguredTable", "cleanrooms:UpdateConfiguredTableAnalysisRule", "cleanrooms:UpdateConfiguredTableAssociation", "cleanrooms:UpdateMembership", "cleanrooms:ListTagsForResource", "cleanrooms:UntagResource", "cleanrooms:TagResource" ], "Resource": "*" }, { "Sid": "CleanRoomsNoQuerying", "Effect": "Deny", "Action": [ "cleanrooms:StartProtectedQuery", "cleanrooms:UpdateProtectedQuery" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-01-12T16:12:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsAccess", "Effect": "Allow", "Action": [ "cleanrooms:BatchGetCollaborationAnalysisTemplate", "cleanrooms:BatchGetSchema", "cleanrooms:BatchGetSchemaAnalysisRule", "cleanrooms:CreateAnalysisTemplate", "cleanrooms:CreateCollaboration", "cleanrooms:CreateConfiguredTable", "cleanrooms:CreateConfiguredTableAnalysisRule", "cleanrooms:CreateConfiguredTableAssociation", "cleanrooms:CreateMembership", "cleanrooms:DeleteAnalysisTemplate", "cleanrooms:DeleteCollaboration", "cleanrooms:DeleteConfiguredTable", "cleanrooms:DeleteConfiguredTableAnalysisRule", "cleanrooms:DeleteConfiguredTableAssociation", "cleanrooms:DeleteMember", "cleanrooms:DeleteMembership", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaborationAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:GetProtectedQuery", "cleanrooms:GetSchema", "cleanrooms:GetSchemaAnalysisRule", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:UpdateAnalysisTemplate", "cleanrooms:UpdateCollaboration", "cleanrooms:UpdateConfiguredTable", "cleanrooms:UpdateConfiguredTableAnalysisRule", "cleanrooms:UpdateConfiguredTableAssociation", "cleanrooms:UpdateMembership", "cleanrooms:ListTagsForResource", "cleanrooms:UntagResource", "cleanrooms:TagResource" ], "Resource": "*" }, { "Sid": "CleanRoomsNoQuerying", "Effect": "Deny", "Action": [ "cleanrooms:StartProtectedQuery", "cleanrooms:UpdateProtectedQuery" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*", "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms.amazonaws.com" } } }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/service-role/*cleanrooms*" }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanrooms*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "EstablishLogDeliveries", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsCreate", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "SetupLogGroupsResourcePolicy", "Effect": "Allow", "Action": [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cleanrooms.amazonaws.com" } } }, { "Sid": "ConsoleLogSummaryQueryLogs", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*" }, { "Sid": "ConsoleLogSummaryObtainLogs", "Effect": "Allow", "Action": [ "logs:GetQueryResults" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-12T16:12:31.000Z", "lastUpdatedDate": "2024-05-14T18:31:21.000Z" }, "AWSHealth_EventProcessorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSHealth_EventProcessorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-13T19:24:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:PutRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "event-processor.health.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-13T19:24:56.000Z", "lastUpdatedDate": "2023-01-13T19:24:56.000Z" }, "AmazonDetectiveMemberAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDetectiveMemberAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-17T15:16:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:AcceptInvitation", "detective:BatchGetMembershipDatasources", "detective:DisassociateMembership", "detective:GetFreeTrialEligibility", "detective:GetPricingInformation", "detective:GetUsageInformation", "detective:ListInvitations", "detective:RejectInvitation" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-17T15:16:14.000Z", "lastUpdatedDate": "2023-01-17T15:16:14.000Z" }, "AmazonDetectiveInvestigatorAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDetectiveInvestigatorAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-01-17T15:24:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:DescribeOrganizationConfiguration", "detective:GetFreeTrialEligibility", "detective:GetGraphIngestState", "detective:GetMembers", "detective:GetPricingInformation", "detective:GetUsageInformation", "detective:ListDatasourcePackages", "detective:ListGraphs", "detective:ListHighDegreeEntities", "detective:ListInvitations", "detective:ListMembers", "detective:ListOrganizationAdminAccount", "detective:ListTagsForResource", "detective:SearchGraph" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings", "guardduty:GetFindings", "guardduty:ListDetectors" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-17T19:41:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:DescribeOrganizationConfiguration", "detective:GetFreeTrialEligibility", "detective:GetGraphIngestState", "detective:GetMembers", "detective:GetPricingInformation", "detective:GetUsageInformation", "detective:ListDatasourcePackages", "detective:ListGraphs", "detective:ListHighDegreeEntities", "detective:ListInvitations", "detective:ListMembers", "detective:ListOrganizationAdminAccount", "detective:ListTagsForResource", "detective:SearchGraph" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings", "guardduty:GetFindings", "guardduty:ListDetectors" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "securityHub:GetFindings" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-01-17T15:24:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DetectivePermissions", "Effect": "Allow", "Action": [ "detective:BatchGetGraphMemberDatasources", "detective:BatchGetMembershipDatasources", "detective:DescribeOrganizationConfiguration", "detective:GetFreeTrialEligibility", "detective:GetGraphIngestState", "detective:GetMembers", "detective:GetPricingInformation", "detective:GetUsageInformation", "detective:ListDatasourcePackages", "detective:ListGraphs", "detective:ListHighDegreeEntities", "detective:ListInvitations", "detective:ListMembers", "detective:ListOrganizationAdminAccount", "detective:ListTagsForResource", "detective:SearchGraph", "detective:StartInvestigation", "detective:GetInvestigation", "detective:ListInvestigations", "detective:UpdateInvestigationState", "detective:ListIndicators", "detective:InvokeAssistant" ], "Resource": "*" }, { "Sid": "OrganizationsPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Sid": "GuardDutyPermissions", "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings", "guardduty:GetFindings", "guardduty:ListDetectors" ], "Resource": "*" }, { "Sid": "SecurityHubPermissions", "Effect": "Allow", "Action": [ "securityHub:GetFindings" ], "Resource": "*" } ] } } }, "createdDate": "2023-01-17T15:24:26.000Z", "lastUpdatedDate": "2023-11-27T03:13:25.000Z" }, "Ec2InstanceConnectEndpoint": { "arn": "arn:aws:iam::aws:policy/aws-service-role/Ec2InstanceConnectEndpoint", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-01-24T20:19:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "InstanceConnectEndpointId" ] }, "Null": { "aws:RequestTag/InstanceConnectEndpointId": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:ResourceTag/InstanceConnectEndpointId": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "InstanceConnectEndpointId" ] }, "Null": { "aws:RequestTag/InstanceConnectEndpointId": "false" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/InstanceConnectEndpointId": [ "eice-*" ] } } } ] } } }, "createdDate": "2023-01-24T20:19:21.000Z", "lastUpdatedDate": "2023-01-24T20:19:21.000Z" }, "AmazonCognitoUnauthenticatedIdentities": { "arn": "arn:aws:iam::aws:policy/AmazonCognitoUnauthenticatedIdentities", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-01T22:36:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "rum:PutRumEvents", "Resource": "*" } ] } } }, "createdDate": "2023-02-01T22:36:27.000Z", "lastUpdatedDate": "2023-02-01T22:36:27.000Z" }, "AWSManagedServices_EventsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSManagedServices_EventsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-07T18:41:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:PutRule", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "events.managedservices.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "*" } ] } } }, "createdDate": "2023-02-07T18:41:22.000Z", "lastUpdatedDate": "2023-02-07T18:41:22.000Z" }, "AWSPrivateCAUser": { "arn": "arn:aws:iam::aws:policy/AWSPrivateCAUser", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-02-14T18:16:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/EndEntityCertificate/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/EndEntityCertificate/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-02-14T18:16:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/EndEntityCertificate/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/EndEntityCertificate/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2023-02-14T18:16:08.000Z", "lastUpdatedDate": "2025-01-22T21:22:07.000Z" }, "AWSPrivateCAFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPrivateCAFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-14T18:20:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:*" ], "Resource": "*" } ] } } }, "createdDate": "2023-02-14T18:20:59.000Z", "lastUpdatedDate": "2023-02-14T18:20:59.000Z" }, "AWSPrivateCAPrivilegedUser": { "arn": "arn:aws:iam::aws:policy/AWSPrivateCAPrivilegedUser", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-02-14T18:26:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/*CACertificate*/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "StringNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:::template/*CACertificate*/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-02-14T18:26:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/*CACertificate*/V*" ] } } }, { "Effect": "Deny", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*", "Condition": { "ArnNotLike": { "acm-pca:TemplateArn": [ "arn:aws:acm-pca:*:*:template/*CACertificate*/V*" ] } } }, { "Effect": "Allow", "Action": [ "acm-pca:RevokeCertificate", "acm-pca:GetCertificate", "acm-pca:ListPermissions" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2023-02-14T18:26:02.000Z", "lastUpdatedDate": "2025-01-22T21:07:06.000Z" }, "AWSPrivateCAReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSPrivateCAReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-14T18:30:50.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:ListCertificateAuthorities", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:GetPolicy", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "*" } } } }, "createdDate": "2023-02-14T18:30:50.000Z", "lastUpdatedDate": "2023-02-14T18:30:50.000Z" }, "AWSPrivateCAAuditor": { "arn": "arn:aws:iam::aws:policy/AWSPrivateCAAuditor", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-14T18:33:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "acm-pca:CreateCertificateAuthorityAuditReport", "acm-pca:DescribeCertificateAuthority", "acm-pca:DescribeCertificateAuthorityAuditReport", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificate", "acm-pca:GetPolicy", "acm-pca:ListPermissions", "acm-pca:ListTags" ], "Resource": "arn:aws:acm-pca:*:*:certificate-authority/*" }, { "Effect": "Allow", "Action": [ "acm-pca:ListCertificateAuthorities" ], "Resource": "*" } ] } } }, "createdDate": "2023-02-14T18:33:44.000Z", "lastUpdatedDate": "2023-02-14T18:33:44.000Z" }, "AWSIotRoboRunnerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIotRoboRunnerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-21T16:56:31.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Usage" ] } } } } } }, "createdDate": "2023-02-21T16:56:31.000Z", "lastUpdatedDate": "2023-02-21T16:56:31.000Z" }, "AmazonOmicsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOmicsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-02-24T00:59:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "omics:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation", "ram:GetResourceShareInvitations" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "omics.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "omics.amazonaws.com" } } } ] } } }, "createdDate": "2023-02-24T00:59:33.000Z", "lastUpdatedDate": "2023-02-24T00:59:33.000Z" }, "AWSSupplyChainFederationAdminAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSSupplyChainFederationAdminAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-03-01T18:54:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "scn:*" ], "Resource": [ "arn:aws:scn:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "chime:BatchCreateChannelMembership", "chime:CreateAppInstanceUser", "chime:CreateChannel", "chime:CreateChannelMembership", "chime:CreateChannelModerator", "chime:Connect", "chime:DeleteChannelMembership", "chime:DeleteChannelModerator", "chime:DescribeChannelMembershipForAppInstanceUser", "chime:GetChannelMembershipPreferences", "chime:ListChannelMemberships", "chime:ListChannelMembershipsForAppInstanceUser", "chime:ListChannelMessages", "chime:ListChannelModerators", "chime:TagResource", "chime:PutChannelMembershipPreferences", "chime:SendChannelMessage", "chime:UpdateChannelReadMarker", "chime:UpdateAppInstanceUser" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/SCNInstanceId": "*" } } }, { "Effect": "Allow", "Action": [ "chime:DescribeChannel" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ] }, { "Effect": "Allow", "Action": [ "chime:GetMessagingSessionEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:ListProfiles", "sso:GetProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "appflow:CreateConnectorProfile", "appflow:UseConnectorProfile", "appflow:DeleteConnectorProfile", "appflow:UpdateConnectorProfile" ], "Resource": [ "arn:aws:appflow:*:*:connectorprofile/scn-*" ] }, { "Effect": "Allow", "Action": [ "appflow:CreateFlow", "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow", "appflow:TagResource", "appflow:UntagResource" ], "Resource": [ "arn:aws:appflow:*:*:flow/scn-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ] }, { "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } } ] } }, "v2": { "createdDate": "2023-03-01T18:54:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "scn:*" ], "Resource": [ "arn:aws:scn:*:*:instance/*" ] }, { "Effect": "Allow", "Action": [ "chime:BatchCreateChannelMembership", "chime:CreateAppInstanceUser", "chime:CreateChannel", "chime:CreateChannelMembership", "chime:CreateChannelModerator", "chime:Connect", "chime:DeleteChannelMembership", "chime:DeleteChannelModerator", "chime:DescribeChannelMembershipForAppInstanceUser", "chime:GetChannelMembershipPreferences", "chime:ListChannelMemberships", "chime:ListChannelMembershipsForAppInstanceUser", "chime:ListChannelMessages", "chime:ListChannelModerators", "chime:TagResource", "chime:PutChannelMembershipPreferences", "chime:SendChannelMessage", "chime:UpdateChannelReadMarker", "chime:UpdateAppInstanceUser" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/SCNInstanceId": "*" } } }, { "Effect": "Allow", "Action": [ "chime:DescribeChannel" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ] }, { "Effect": "Allow", "Action": [ "chime:GetMessagingSessionEndpoint" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:ListProfiles", "sso:GetProfile" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "appflow:CreateConnectorProfile", "appflow:UseConnectorProfile", "appflow:DeleteConnectorProfile", "appflow:UpdateConnectorProfile" ], "Resource": [ "arn:aws:appflow:*:*:connectorprofile/scn-*" ] }, { "Effect": "Allow", "Action": [ "appflow:CreateFlow", "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow", "appflow:TagResource", "appflow:UntagResource" ], "Resource": [ "arn:aws:appflow:*:*:flow/scn-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } }, { "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } } ] } }, "v3": { "createdDate": "2023-03-01T18:54:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSupplyChain", "Effect": "Allow", "Action": [ "scn:*" ], "Resource": [ "arn:aws:scn:*:*:instance/*" ] }, { "Sid": "ChimeAppInstance", "Effect": "Allow", "Action": [ "chime:BatchCreateChannelMembership", "chime:CreateAppInstanceUser", "chime:CreateChannel", "chime:CreateChannelMembership", "chime:CreateChannelModerator", "chime:Connect", "chime:DeleteChannelMembership", "chime:DeleteChannelModerator", "chime:DescribeChannelMembershipForAppInstanceUser", "chime:GetChannelMembershipPreferences", "chime:ListChannelMemberships", "chime:ListChannelMembershipsForAppInstanceUser", "chime:ListChannelMessages", "chime:ListChannelModerators", "chime:TagResource", "chime:PutChannelMembershipPreferences", "chime:SendChannelMessage", "chime:UpdateChannelReadMarker", "chime:UpdateAppInstanceUser" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/SCNInstanceId": "*" } } }, { "Sid": "ChimeChannel", "Effect": "Allow", "Action": [ "chime:DescribeChannel" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ] }, { "Sid": "ChimeMessaging", "Effect": "Allow", "Action": [ "chime:GetMessagingSessionEndpoint" ], "Resource": "*" }, { "Sid": "IAMIdentityCenter", "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:ListProfiles", "sso:GetProfile", "sso:ListProfileAssociations" ], "Resource": "*" }, { "Sid": "AppflowConnectorProfile", "Effect": "Allow", "Action": [ "appflow:CreateConnectorProfile", "appflow:UseConnectorProfile", "appflow:DeleteConnectorProfile", "appflow:UpdateConnectorProfile" ], "Resource": [ "arn:aws:appflow:*:*:connectorprofile/scn-*" ] }, { "Sid": "AppflowFlow", "Effect": "Allow", "Action": [ "appflow:CreateFlow", "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow", "appflow:TagResource", "appflow:UntagResource" ], "Resource": [ "arn:aws:appflow:*:*:flow/scn-*" ] }, { "Sid": "S3ListAllBuckets", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "S3ListSupplyChainBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ] }, { "Sid": "S3ReadWriteObject", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecretsManagerCreateSecret", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Sid": "SecretsManagerPutResourcePolicy", "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } }, { "Sid": "KMSListKeys", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "KMSListGrants", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } }, { "Sid": "KMSCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } } ] } }, "v4": { "createdDate": "2023-03-01T18:54:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSSupplyChain", "Effect": "Allow", "Action": [ "scn:*" ], "Resource": [ "arn:aws:scn:*:*:instance/*" ] }, { "Sid": "ChimeAppInstance", "Effect": "Allow", "Action": [ "chime:BatchCreateChannelMembership", "chime:CreateAppInstanceUser", "chime:CreateChannel", "chime:CreateChannelMembership", "chime:CreateChannelModerator", "chime:Connect", "chime:DeleteChannelMembership", "chime:DeleteChannelModerator", "chime:DescribeChannelMembershipForAppInstanceUser", "chime:GetChannelMembershipPreferences", "chime:ListChannelMemberships", "chime:ListChannelMembershipsForAppInstanceUser", "chime:ListChannelMessages", "chime:ListChannelModerators", "chime:TagResource", "chime:PutChannelMembershipPreferences", "chime:SendChannelMessage", "chime:UpdateChannelReadMarker", "chime:UpdateAppInstanceUser" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/SCNInstanceId": "*" } } }, { "Sid": "ChimeChannel", "Effect": "Allow", "Action": [ "chime:DescribeChannel" ], "Resource": [ "arn:aws:chime:*:*:app-instance/*" ] }, { "Sid": "ChimeMessaging", "Effect": "Allow", "Action": [ "chime:GetMessagingSessionEndpoint" ], "Resource": "*" }, { "Sid": "IAMIdentityCenter", "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:ListProfiles", "sso:GetProfile", "sso:ListProfileAssociations", "sso:ListApplicationAssignments", "sso:DescribeApplication", "sso:DescribeInstance", "sso:GetApplicationAssignmentConfiguration" ], "Resource": "*" }, { "Sid": "AppflowConnectorProfile", "Effect": "Allow", "Action": [ "appflow:CreateConnectorProfile", "appflow:UseConnectorProfile", "appflow:DeleteConnectorProfile", "appflow:UpdateConnectorProfile" ], "Resource": [ "arn:aws:appflow:*:*:connectorprofile/scn-*" ] }, { "Sid": "AppflowFlow", "Effect": "Allow", "Action": [ "appflow:CreateFlow", "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow", "appflow:TagResource", "appflow:UntagResource" ], "Resource": [ "arn:aws:appflow:*:*:flow/scn-*" ] }, { "Sid": "S3ListAllBuckets", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "S3ListSupplyChainBucket", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ] }, { "Sid": "S3ReadWriteObject", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-supply-chain-data-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecretsManagerCreateSecret", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:Name": "appflow!*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] } } }, { "Sid": "SecretsManagerPutResourcePolicy", "Effect": "Allow", "Action": [ "secretsmanager:PutResourcePolicy" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appflow" } } }, { "Sid": "KMSListKeys", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "KMSListGrants", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } }, { "Sid": "KMSCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": "appflow.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }, "StringEquals": { "aws:ResourceTag/aws-supply-chain-access": "true" } } } ] } } }, "createdDate": "2023-03-01T18:54:25.000Z", "lastUpdatedDate": "2024-12-11T21:36:24.000Z" }, "AmazonDetectiveOrganizationsAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDetectiveOrganizationsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-02T15:20:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "detective:DisableOrganizationAdminAccount", "detective:EnableOrganizationAdminAccount", "detective:ListOrganizationAdminAccount" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "detective.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "detective.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "detective.amazonaws.com", "guardduty.amazonaws.com", "macie.amazonaws.com", "securityhub.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-03-02T15:20:50.000Z", "lastUpdatedDate": "2023-03-02T15:20:50.000Z" }, "AmazonChimeSDKMessagingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonChimeSDKMessagingServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-03T01:43:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "kinesis.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:DescribeStream" ], "Resource": [ "arn:aws:kinesis:*:*:stream/chime-messaging-*" ] } ] } } }, "createdDate": "2023-03-03T01:43:49.000Z", "lastUpdatedDate": "2023-03-03T01:43:49.000Z" }, "AWSDMSFleetAdvisorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDMSFleetAdvisorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-06T09:10:42.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/DMS/FleetAdvisor" } } } } } }, "createdDate": "2023-03-06T09:10:42.000Z", "lastUpdatedDate": "2023-03-06T09:10:42.000Z" }, "CustomerProfilesServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CustomerProfilesServiceLinkedRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-03-07T22:56:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/CustomerProfiles" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/profile.amazonaws.com/AWSServiceRoleForProfile_*" } ] } }, "v2": { "createdDate": "2023-03-07T22:56:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/CustomerProfiles" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/profile.amazonaws.com/AWSServiceRoleForProfile_*" }, { "Effect": "Allow", "Action": [ "connect-campaigns:PutProfileOutboundRequestBatch" ], "Resource": [ "arn:aws:connect-campaigns:*:*:campaign/*" ] }, { "Effect": "Allow", "Action": [ "profile:BatchGetProfile" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-07T22:56:52.000Z", "lastUpdatedDate": "2024-11-26T22:21:06.000Z" }, "AWSDataSyncDiscoveryServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDataSyncDiscoveryServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-20T22:19:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "arn:*:secretsmanager:*:*:secret:datasync!*" ], "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "datasync", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": [ "arn:*:logs:*:*:log-group:/aws/datasync*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:*:logs:*:*:log-group:/aws/datasync:log-stream:*" ] } ] } } }, "createdDate": "2023-03-20T22:19:51.000Z", "lastUpdatedDate": "2023-03-20T22:19:51.000Z" }, "AmazonDataZoneProjectRolePermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-21T02:51:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:List*", "s3:Get*", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:ReplicateObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutObjectRetention", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "s3:List*", "s3:Get*", "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "ec2:Describe*", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "logs:*", "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGet*", "athena:List*", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:Get*", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "organizations:DescribeOrganization", "organizations:DescribeAccount", "lakeformation:GetDataAccess", "lakeformation:BatchGrantPermissions", "lakeformation:GrantPermissions", "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:BatchRevokePermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "ram:CreateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:AcceptResourceShareInvitation", "ram:Get*", "ram:List*", "redshift:DescribeClusters", "redshift:JoinGroup", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift-data:*", "redshift:AuthorizeDataShare", "redshift:DescribeDataShares", "redshift:AssociateDataShareConsumer", "tag:GetResources", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "glue:CreateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateDataQualityRuleset", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateWorkflow", "sqlworkbench:*", "datazone:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } } }, { "Effect": "Allow", "Action": [ "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:Verify", "kms:Sign", "kms:GenerateDataKey", "glue:*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/datazone:projectId": "false" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ] }, { "Effect": "Allow", "Action": [ "glue:BatchGet*", "glue:SearchTables", "glue:List*", "glue:Get*", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:PutResourcePolicy", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:UpdatePartition", "glue:NotifyEvent", "glue:DeleteResourcePolicy" ], "Resource": "*" }, { "Effect": "Deny", "NotAction": [ "s3:List*", "s3:Get*", "s3:Describe*", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:ReplicateObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutObjectRetention", "s3:DeleteObject", "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:Verify", "kms:Sign", "kms:GenerateDataKey", "ec2:Describe*", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateTags", "ec2:DeleteTags", "logs:*", "athena:*", "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:PutResourcePolicy", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:UpdatePartition", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "lakeformation:GetDataAccess", "lakeformation:BatchGrantPermissions", "lakeformation:GrantPermissions", "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:BatchRevokePermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "ram:*", "redshift:*", "redshift-data:*", "tag:GetResources", "iam:List*", "iam:GetRole", "iam:GetRolePolicy", "iam:PassRole", "sqlworkbench:*", "datazone:*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2023-03-21T02:51:56.000Z", "lastUpdatedDate": "2023-03-21T02:51:56.000Z" }, "AmazonDataZoneProjectDeploymentPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneProjectDeploymentPermissionsBoundary", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-03-21T02:54:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/*datazone*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect": "Allow", "Action": [ "kms:CreateKey", "kms:TagResource", "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:CreateLogGroup", "logs:TagLogGroup", "ssm:AddTagsToResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "datazone:*" }, "StringLike": { "aws:ResourceTag/datazone:projectId": "proj-*" } } }, { "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "kms:ScheduleKeyDeletion", "kms:DescribeKey", "kms:EnableKeyRotation", "kms:DisableKeyRotation", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/datazone:projectId": "proj-*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "datazone:projectId" } } }, { "Effect": "Allow", "Action": [ "iam:DeletePolicy", "s3:DeleteBucket" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:s3:::datazone*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameter*", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/*datazone*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:GetDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "sts:GetCallerIdentity" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect": "Allow", "Action": [ "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:PutBucketLogging", "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Resource": "arn:aws:s3:::*datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "athena:Get*", "athena:List*", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup", "ec2:Describe*", "ec2:Get*", "ec2:List*", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:PutKeyPolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "NotResource": "arn:aws:ec2:*:*:vpc-endpoint/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.logs", "com.amazonaws.*.s3", "com.amazonaws.*.glue", "com.amazonaws.*.athena" ] } } }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:GetTemplateSummary" ], "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Effect": "Deny", "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*", "s3:DeleteBucket" ], "NotResource": [ "arn:aws:s3:::*datazone*" ] }, { "Effect": "Deny", "Action": [ "kms:*" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Deny", "NotAction": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:GetParameter", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketAcl", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:ListBucket", "s3:PutBucketLogging", "s3:DeleteBucket", "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "iam:DeletePolicy", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplateSummary", "athena:*", "kms:*", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "lambda:*", "ec2:*", "logs:*", "servicecatalog:CreateApplication", "servicecatalog:DeleteApplication", "servicecatalog:GetApplication", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "iam:CreateRole", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:PassRole", "iam:TagRole", "s3:GetBucket*", "s3:GetObject*", "s3:Abort*", "s3:GetEncryptionConfiguration", "s3:PutObject*" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2023-04-04T02:48:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/*datazone*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect": "Allow", "Action": [ "kms:CreateKey", "kms:TagResource", "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:CreateLogGroup", "logs:TagLogGroup", "ssm:AddTagsToResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "datazone:*" }, "StringLike": { "aws:ResourceTag/datazone:projectId": "proj-*" } } }, { "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "kms:ScheduleKeyDeletion", "kms:DescribeKey", "kms:EnableKeyRotation", "kms:DisableKeyRotation", "kms:GenerateDataKey", "kms:Encrypt", "kms:Decrypt", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/datazone:projectId": "proj-*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "datazone:projectId" } } }, { "Effect": "Allow", "Action": [ "iam:DeletePolicy", "s3:DeleteBucket" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:s3:::datazone*" ] }, { "Effect": "Allow", "Action": [ "ssm:GetParameter*", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/*datazone*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:GetDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "sts:GetCallerIdentity" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect": "Allow", "Action": [ "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:PutBucketLogging", "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Resource": "arn:aws:s3:::*datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "athena:Get*", "athena:List*", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup", "ec2:Describe*", "ec2:Get*", "ec2:List*", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:PutKeyPolicy" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "NotResource": "arn:aws:ec2:*:*:vpc-endpoint/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.logs", "com.amazonaws.*.s3", "com.amazonaws.*.glue", "com.amazonaws.*.athena" ] } } }, { "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:GetTemplateSummary" ], "Effect": "Allow", "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Effect": "Deny", "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*", "s3:DeleteBucket" ], "NotResource": [ "arn:aws:s3:::*datazone*" ] }, { "Effect": "Deny", "Action": [ "kms:*" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Deny", "NotAction": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:GetParameter", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketAcl", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:ListBucket", "s3:PutBucketLogging", "s3:DeleteBucket", "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "iam:DeletePolicy", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplateSummary", "athena:*", "kms:*", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "lambda:*", "ec2:*", "logs:*", "servicecatalog:CreateApplication", "servicecatalog:DeleteApplication", "servicecatalog:GetApplication", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "iam:CreateRole", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:PassRole", "iam:TagRole", "s3:GetBucket*", "s3:GetObject*", "s3:Abort*", "s3:GetEncryptionConfiguration", "s3:PutObject*" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2023-03-21T02:54:30.000Z", "lastUpdatedDate": "2023-04-04T02:48:38.000Z" }, "MediaConnectGatewayInstanceRolePolicy": { "arn": "arn:aws:iam::aws:policy/MediaConnectGatewayInstanceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-22T20:43:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MediaConnectGateway", "Effect": "Allow", "Action": [ "mediaconnect:DiscoverGatewayPollEndpoint", "mediaconnect:PollGateway", "mediaconnect:SubmitGatewayStateChange" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-22T20:43:25.000Z", "lastUpdatedDate": "2023-03-22T20:43:25.000Z" }, "AWSManagedServices_ContactsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSManagedServices_ContactsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-23T17:07:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ListRoleTags", "iam:ListUserTags", "tag:GetResources", "ec2:DescribeTags" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:GetBucketTagging", "Resource": "*", "Condition": { "StringEquals": { "s3:authType": "REST-HEADER", "s3:signatureversion": "AWS4-HMAC-SHA256" }, "NumericGreaterThanEquals": { "s3:TlsVersion": "1.2" } } } ] } } }, "createdDate": "2023-03-23T17:07:46.000Z", "lastUpdatedDate": "2023-03-23T17:07:46.000Z" }, "AmazonSageMakerCanvasAIServicesAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasAIServicesAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-03-23T22:36:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "textract:AnalyzeDocument", "textract:AnalyzeExpense", "textract:AnalyzeID", "textract:StartDocumentAnalysis", "textract:StartExpenseAnalysis", "textract:GetDocumentAnalysis", "textract:GetExpenseAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rekognition:DetectLabels", "rekognition:DetectText" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "comprehend:BatchDetectDominantLanguage", "comprehend:BatchDetectEntities", "comprehend:BatchDetectSentiment", "comprehend:DetectPiiEntities", "comprehend:DetectEntities", "comprehend:DetectSentiment", "comprehend:DetectDominantLanguage" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-03-23T22:36:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "textract:AnalyzeDocument", "textract:AnalyzeExpense", "textract:AnalyzeID", "textract:StartDocumentAnalysis", "textract:StartExpenseAnalysis", "textract:GetDocumentAnalysis", "textract:GetExpenseAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "rekognition:DetectLabels", "rekognition:DetectText" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "comprehend:BatchDetectDominantLanguage", "comprehend:BatchDetectEntities", "comprehend:BatchDetectSentiment", "comprehend:DetectPiiEntities", "comprehend:DetectEntities", "comprehend:DetectSentiment", "comprehend:DetectDominantLanguage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:ListFoundationModels" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-03-23T22:36:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Textract", "Effect": "Allow", "Action": [ "textract:AnalyzeDocument", "textract:AnalyzeExpense", "textract:AnalyzeID", "textract:StartDocumentAnalysis", "textract:StartExpenseAnalysis", "textract:GetDocumentAnalysis", "textract:GetExpenseAnalysis" ], "Resource": "*" }, { "Sid": "Rekognition", "Effect": "Allow", "Action": [ "rekognition:DetectLabels", "rekognition:DetectText" ], "Resource": "*" }, { "Sid": "Comprehend", "Effect": "Allow", "Action": [ "comprehend:BatchDetectDominantLanguage", "comprehend:BatchDetectEntities", "comprehend:BatchDetectSentiment", "comprehend:DetectPiiEntities", "comprehend:DetectEntities", "comprehend:DetectSentiment", "comprehend:DetectDominantLanguage" ], "Resource": "*" }, { "Sid": "Bedrock", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:ListFoundationModels", "bedrock:InvokeModelWithResponseStream" ], "Resource": "*" }, { "Sid": "CreateBedrockResourcesPermission", "Effect": "Allow", "Action": [ "bedrock:CreateModelCustomizationJob", "bedrock:CreateProvisionedModelThroughput", "bedrock:TagResource" ], "Resource": [ "arn:aws:bedrock:*:*:model-customization-job/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "SageMaker", "Canvas" ] }, "StringEquals": { "aws:RequestTag/SageMaker": "true", "aws:RequestTag/Canvas": "true", "aws:ResourceTag/SageMaker": "true", "aws:ResourceTag/Canvas": "true" } } }, { "Sid": "GetStopAndDeleteBedrockResourcesPermission", "Effect": "Allow", "Action": [ "bedrock:GetModelCustomizationJob", "bedrock:GetCustomModel", "bedrock:GetProvisionedModelThroughput", "bedrock:StopModelCustomizationJob", "bedrock:DeleteProvisionedModelThroughput" ], "Resource": [ "arn:aws:bedrock:*:*:model-customization-job/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/SageMaker": "true", "aws:ResourceTag/Canvas": "true" } } }, { "Sid": "FoundationModelPermission", "Effect": "Allow", "Action": [ "bedrock:CreateModelCustomizationJob" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid": "BedrockFineTuningPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*" ], "Condition": { "StringEquals": { "iam:PassedToService": "bedrock.amazonaws.com" } } } ] } } }, "createdDate": "2023-03-23T22:36:43.000Z", "lastUpdatedDate": "2023-11-29T14:47:09.000Z" }, "AWSServiceRoleForCodeWhispererPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForCodeWhispererPolicy", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v2": { "createdDate": "2023-05-26T18:27:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:ListProfileAssociations", "sso:ListProfiles", "sso:ListDirectoryAssociations", "sso:DescribeRegisteredRegions", "sso:GetProfile" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateUploadUrl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings" ], "Resource": [ "arn:aws:codeguru-security:*:*:scans/CodeWhisperer-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/CodeWhisperer" ] } } } ] } }, "v1": { "createdDate": "2023-03-24T19:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:ListProfileAssociations", "sso:ListProfiles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateUploadUrl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings" ], "Resource": [ "arn:aws:codeguru-security:*:*:scans/CodeWhisperer-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/CodeWhisperer" ] } } } ] } }, "v3": { "createdDate": "2023-06-28T16:57:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:ListProfileAssociations", "sso:ListProfiles", "sso:ListDirectoryAssociations", "sso:DescribeRegisteredRegions", "sso:GetProfile", "sso:GetManagedApplicationInstance" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateUploadUrl" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:GetFindings" ], "Resource": [ "arn:aws:codeguru-security:*:*:scans/CodeWhisperer-*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/CodeWhisperer" ] } } } ] } }, "v4": { "createdDate": "2023-03-24T19:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "sid1", "Effect": "Allow", "Action": [ "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Sid": "sid2", "Effect": "Allow", "Action": [ "sso:ListProfileAssociations", "sso:ListProfiles", "sso:ListDirectoryAssociations", "sso:DescribeRegisteredRegions", "sso:GetProfile", "sso:GetManagedApplicationInstance", "sso:ListApplicationAssignments", "sso:DescribeInstance" ], "Resource": [ "*" ] }, { "Sid": "sid3", "Effect": "Allow", "Action": [ "codeguru-security:CreateUploadUrl" ], "Resource": [ "*" ] }, { "Sid": "sid4", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:GetFindings" ], "Resource": [ "arn:aws:codeguru-security:*:*:scans/CodeWhisperer-*" ] }, { "Sid": "sid5", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/CodeWhisperer" ] } } } ] } }, "v5": { "createdDate": "2023-03-24T19:39:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "sid1", "Effect": "Allow", "Action": [ "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Sid": "sid2", "Effect": "Allow", "Action": [ "sso:ListProfileAssociations", "sso:ListProfiles", "sso:ListDirectoryAssociations", "sso:DescribeRegisteredRegions", "sso:GetProfile", "sso:GetManagedApplicationInstance", "sso:ListApplicationAssignments", "sso:DescribeInstance", "sso:DescribeApplication" ], "Resource": [ "*" ] }, { "Sid": "sid3", "Effect": "Allow", "Action": [ "codeguru-security:CreateUploadUrl" ], "Resource": [ "*" ] }, { "Sid": "sid4", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:GetFindings" ], "Resource": [ "arn:aws:codeguru-security:*:*:scans/CodeWhisperer-*" ] }, { "Sid": "sid5", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/CodeWhisperer" ] } } } ] } } }, "createdDate": "2023-03-24T19:39:12.000Z", "lastUpdatedDate": "2024-03-29T22:13:56.000Z" }, "AmazonGrafanaCloudWatchAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonGrafanaCloudWatchAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-24T22:41:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "cloudwatch:GetInsightRuleReport" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:GetLogGroupFields", "logs:StartQuery", "logs:StopQuery", "logs:GetQueryResults", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:ListSinks", "oam:ListAttachedLinks" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-24T22:41:53.000Z", "lastUpdatedDate": "2023-03-24T22:41:53.000Z" }, "AmazonDataZonePortalFullAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonDataZonePortalFullAccessPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-26T18:24:35.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "datazonecontrol:*", "Resource": "*" } ] } } }, "createdDate": "2023-03-26T18:24:35.000Z", "lastUpdatedDate": "2023-03-26T18:24:35.000Z" }, "AmazonDataZonePreviewConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDataZonePreviewConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v2": { "createdDate": "2023-07-13T18:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datazonecontrol:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "glue:GetConnections", "glue:GetDatabase", "redshift:DescribeClusters", "ec2:DescribeSubnets", "secretsmanager:ListSecrets", "iam:ListRoles", "sso:DescribeRegisteredRegions" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AmazonDataZone-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*" }, { "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneBootstrapServicePolicy-AmazonDataZoneBootstrapRole", "arn:aws:iam::*:policy/service-role/AmazonDataZoneServicePolicy-AmazonDataZoneServiceRole" ] }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZoneServiceRole*", "arn:aws:iam::*:role/service-role/AmazonDataZoneServiceRole*", "arn:aws:iam::*:role/AmazonDataZoneBootstrapRole*", "arn:aws:iam::*:role/service-role/AmazonDataZoneBootstrapRole", "arn:aws:iam::*:role/AmazonDataZoneDomainExecutionRole", "arn:aws:iam::*:role/service-role/AmazonDataZoneDomainExecutionRole" ], "Condition": { "StringEquals": { "iam:passedToService": "datazonecontrol.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2023-03-28T15:16:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datazonecontrol:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "glue:GetConnections", "glue:GetDatabase", "redshift:DescribeClusters", "ec2:DescribeSubnets", "secretsmanager:ListSecrets", "iam:ListRoles", "sso:DescribeRegisteredRegions" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/AmazonDataZone-*" ] }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZoneServiceRole*", "arn:aws:iam::*:role/service-role/AmazonDataZoneServiceRole*", "arn:aws:iam::*:role/AmazonDataZoneBootstrapRole*", "arn:aws:iam::*:role/service-role/AmazonDataZoneBootstrapRole", "arn:aws:iam::*:role/AmazonDataZoneDomainExecutionRole", "arn:aws:iam::*:role/service-role/AmazonDataZoneDomainExecutionRole" ], "Condition": { "StringEquals": { "iam:passedToService": "datazonecontrol.amazonaws.com" } } } ] } } }, "createdDate": "2023-03-28T15:16:04.000Z", "lastUpdatedDate": "2023-07-13T18:01:12.000Z" }, "AWSGroundStationAgentInstancePolicy": { "arn": "arn:aws:iam::aws:policy/AWSGroundStationAgentInstancePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-29T15:23:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "groundstation:RegisterAgent", "groundstation:UpdateAgentStatus", "groundstation:GetAgentConfiguration" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-29T15:23:12.000Z", "lastUpdatedDate": "2023-03-29T15:23:12.000Z" }, "VPCLatticeServicesInvokeAccess": { "arn": "arn:aws:iam::aws:policy/VPCLatticeServicesInvokeAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-03-30T02:45:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vpc-lattice-svcs:Invoke" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-30T02:45:07.000Z", "lastUpdatedDate": "2023-03-30T02:45:07.000Z" }, "VPCLatticeReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/VPCLatticeReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-03-30T02:47:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vpc-lattice:Get*", "vpc-lattice:List*", "acm:DescribeCertificate", "acm:ListCertificates", "cloudwatch:GetMetricData", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListLogDeliveries", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-03-30T02:47:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vpc-lattice:Get*", "vpc-lattice:List*", "acm:DescribeCertificate", "acm:ListCertificates", "cloudwatch:GetMetricData", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "logs:DescribeLogGroups", "logs:GetLogDelivery", "logs:ListLogDeliveries", "s3:ListAllMyBuckets", "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" } ] } } }, "createdDate": "2023-03-30T02:47:25.000Z", "lastUpdatedDate": "2024-12-01T14:21:06.000Z" }, "VPCLatticeFullAccess": { "arn": "arn:aws:iam::aws:policy/VPCLatticeFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-03-30T02:49:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vpc-lattice:*", "acm:DescribeCertificate", "acm:ListCertificates", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:UpdateLogDelivery", "logs:DescribeResourcePolicies" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "vpc-lattice.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/vpc-lattice.amazonaws.com/AWSServiceRoleForVpcLattice", "Condition": { "StringLike": { "iam:AWSServiceName": "vpc-lattice.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery", "Condition": { "StringLike": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/vpc-lattice.amazonaws.com/AWSServiceRoleForVpcLattice" } ] } }, "v2": { "createdDate": "2023-03-30T02:49:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "vpc-lattice:*", "acm:DescribeCertificate", "acm:ListCertificates", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "logs:DescribeLogGroups", "s3:ListAllMyBuckets", "lambda:ListAliases", "lambda:ListFunctions", "lambda:ListVersionsByFunction", "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:UpdateLogDelivery", "logs:DescribeResourcePolicies" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "vpc-lattice.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/vpc-lattice.amazonaws.com/AWSServiceRoleForVpcLattice", "Condition": { "StringLike": { "iam:AWSServiceName": "vpc-lattice.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery", "Condition": { "StringLike": { "iam:AWSServiceName": "delivery.logs.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteServiceLinkedRole", "iam:GetServiceLinkedRoleDeletionStatus" ], "Resource": "arn:aws:iam::*:role/aws-service-role/vpc-lattice.amazonaws.com/AWSServiceRoleForVpcLattice" } ] } } }, "createdDate": "2023-03-30T02:49:02.000Z", "lastUpdatedDate": "2024-12-01T14:21:06.000Z" }, "AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-04-03T20:09:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-07-20T15:39:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": [ "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" ], "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2023-04-03T20:09:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RefactorSpaces", "Effect": "Allow", "Action": [ "refactor-spaces:*" ], "Resource": "*" }, { "Sid": "EC2Describe", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcs", "ec2:DescribeTags", "ec2:DescribeAccountAttributes", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Sid": "VpcEndpointServiceConfigurationCreate", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpointServiceConfiguration" ], "Resource": "*" }, { "Sid": "EC2TagsDelete", "Effect": "Allow", "Action": [ "ec2:DeleteTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:environment-id": "false" } } }, { "Sid": "VpcEndpointServiceConfigurationDelete", "Effect": "Allow", "Action": "ec2:DeleteVpcEndpointServiceConfigurations", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Sid": "ELBLoadBalancerCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateLoadBalancer" ], "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:application-id": "false" } } }, { "Sid": "ELBDescribe", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeListeners" ], "Resource": "*" }, { "Sid": "ELBModify", "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteTargetGroup" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/refactor-spaces:route-id": [ "*" ] } } }, { "Sid": "ELBLoadBalancerDelete", "Effect": "Allow", "Action": "elasticloadbalancing:DeleteLoadBalancer", "Resource": "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*" }, { "Sid": "ELBListenerCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener" ], "Resource": [ "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*", "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" ], "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Sid": "ELBListenerDelete", "Effect": "Allow", "Action": "elasticloadbalancing:DeleteListener", "Resource": "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*" }, { "Sid": "ELBTargetGroupModify", "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*" }, { "Sid": "ELBTargetGroupCreate", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateTargetGroup" ], "Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*", "Condition": { "Null": { "aws:RequestTag/refactor-spaces:route-id": "false" } } }, { "Sid": "APIGatewayModify", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:UpdateRestApiPolicy" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*", "arn:aws:apigateway:*::/tags", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/refactor-spaces:application-id": "false" } } }, { "Sid": "APIGatewayVpcLinksGet", "Effect": "Allow", "Action": "apigateway:GET", "Resource": [ "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Sid": "OrganizationDescribe", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "CloudformationStackCreate", "Effect": "Allow", "Action": [ "cloudformation:CreateStack" ], "Resource": "*" }, { "Sid": "CloudformationStackTag", "Effect": "Allow", "Action": [ "cloudformation:TagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/*" }, { "Sid": "CreateRefactorSpacesSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "refactor-spaces.amazonaws.com" } } }, { "Sid": "CreateELBSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } } }, "createdDate": "2023-04-03T20:09:48.000Z", "lastUpdatedDate": "2024-04-11T18:16:48.000Z" }, "AWSMediaConnectServicePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMediaConnectServicePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-03T22:11:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:UpdateService", "ecs:DeleteService", "ecs:CreateService", "ecs:DescribeServices", "ecs:PutAttributes", "ecs:DeleteAttributes", "ecs:RunTask", "ecs:ListTasks", "ecs:StartTask", "ecs:StopTask", "ecs:DescribeTasks", "ecs:DescribeContainerInstances", "ecs:UpdateContainerInstancesState" ], "Resource": "*", "Condition": { "ArnLike": { "ecs:cluster": "arn:aws:ecs:*:*:cluster/MediaConnectGateway" } } }, { "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecs:UpdateCluster", "ecs:UpdateClusterSettings", "ecs:ListAttributes", "ecs:DescribeClusters", "ecs:DeregisterContainerInstance", "ecs:ListContainerInstances" ], "Resource": "arn:aws:ecs:*:*:cluster/MediaConnectGateway" } ] } } }, "createdDate": "2023-04-03T22:11:40.000Z", "lastUpdatedDate": "2023-04-03T22:11:40.000Z" }, "AWSProtonServiceGitSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSProtonServiceGitSyncServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-04T15:55:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProtonServiceSync", "Effect": "Allow", "Action": [ "proton:GetService", "proton:UpdateService", "proton:UpdateServicePipeline", "proton:GetServiceInstance", "proton:CreateServiceInstance", "proton:UpdateServiceInstance", "proton:ListServiceInstances", "proton:GetComponent", "proton:CreateComponent", "proton:ListComponents", "proton:UpdateComponent", "proton:GetEnvironment", "proton:CreateEnvironment", "proton:ListEnvironments", "proton:UpdateEnvironment" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-04T15:55:48.000Z", "lastUpdatedDate": "2023-04-04T15:55:48.000Z" }, "AWSServiceCatalogOrgsDataSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceCatalogOrgsDataSyncServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-10T20:48:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationsDataSyncToServiceCatalog", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListChildren", "organizations:ListParents", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-10T20:48:28.000Z", "lastUpdatedDate": "2023-04-10T20:48:28.000Z" }, "AmazonSageMakerModelRegistryFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerModelRegistryFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-13T05:20:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:DescribeAction", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:ListAssociations", "sagemaker:ListArtifacts", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackages", "sagemaker:Search", "sagemaker:GetSearchSuggestions" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:UpdateModelPackage" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*" }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "sagemaker:collection" } } }, { "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:collection": "true" } } } ] } }, "v2": { "createdDate": "2023-04-13T05:20:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerModelRegistrySageMakerReadPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeAction", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:ListAssociations", "sagemaker:ListArtifacts", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackages", "sagemaker:Search", "sagemaker:GetSearchSuggestions" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistrySageMakerWritePermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:UpdateModelPackage" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistryS3GetPermission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ] }, { "Sid": "AmazonSageMakerModelRegistryS3ListPermission", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistryECRReadPermission", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistryIAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Sid": "AmazonSageMakerModelRegistryTagReadPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*" }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "sagemaker:collection" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": "resource-groups:DeleteGroup", "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:collection": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceKMSPermission", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:DescribeKey", "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker": "true" }, "StringLike": { "kms:ViaService": "sagemaker.*.amazonaws.com" } } } ] } } }, "createdDate": "2023-04-13T05:20:48.000Z", "lastUpdatedDate": "2024-06-06T18:48:51.000Z" }, "AWSUserNotificationsServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSUserNotificationsServiceLinkedRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-19T13:28:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:ListTargetsByRule", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/AWSUserNotificationsManagedRule-*" ] }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Notifications" } }, "Resource": "*" } ] } }, "v2": { "createdDate": "2023-04-19T13:28:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:ListTargetsByRule", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/AWSUserNotificationsManagedRule-*" ] }, { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Notifications" } }, "Resource": "*" }, { "Sid": "AllowOrgsActions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListChildren", "organizations:ListParents" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-19T13:28:34.000Z", "lastUpdatedDate": "2025-01-14T23:37:06.000Z" }, "AmazonCodeCatalystSupportAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonCodeCatalystSupportAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-20T12:34:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "support:DescribeAttachment", "support:DescribeCaseAttributes", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeIssueTypes", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeSupportLevel", "support:SearchForCases", "support:AddAttachmentsToSet", "support:AddCommunicationToCase", "support:CreateCase", "support:InitiateCallForCase", "support:InitiateChatForCase", "support:PutCaseAttributes", "support:RateCaseCommunication", "support:ResolveCase" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-20T12:34:44.000Z", "lastUpdatedDate": "2023-04-20T12:34:44.000Z" }, "AmazonCodeCatalystReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeCatalystReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-20T16:49:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecatalyst:Get*", "codecatalyst:List*" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-20T16:49:12.000Z", "lastUpdatedDate": "2023-04-20T16:49:12.000Z" }, "AmazonCodeCatalystFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeCatalystFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-20T16:50:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CodeCatalystResourceAccess", "Effect": "Allow", "Action": [ "codecatalyst:*", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "CodeCatalystAssociateIAMRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "codecatalyst.amazonaws.com", "codecatalyst-runner.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-04-20T16:50:16.000Z", "lastUpdatedDate": "2023-04-20T16:50:16.000Z" }, "ROSACloudNetworkConfigOperatorPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSACloudNetworkConfigOperatorPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-20T22:34:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeNetworkResources", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "ModifyEIPs", "Effect": "Allow", "Action": [ "ec2:UnassignPrivateIpAddresses", "ec2:AssignPrivateIpAddresses", "ec2:UnassignIpv6Addresses", "ec2:AssignIpv6Addresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } } }, "createdDate": "2023-04-20T22:34:36.000Z", "lastUpdatedDate": "2023-04-20T22:34:36.000Z" }, "ROSAWorkerInstancePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAWorkerInstancePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-20T22:35:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Ec2ReadOnly", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-04-20T22:35:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2DescribeInstancesRegions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": "*" }, { "Sid": "ECRGetAuthorizationToken", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "ECRReadOnlyAccessRedHatManaged", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } } }, "createdDate": "2023-04-20T22:35:32.000Z", "lastUpdatedDate": "2025-03-20T23:07:06.000Z" }, "ROSAAmazonEBSCSIDriverOperatorPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAAmazonEBSCSIDriverOperatorPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-20T22:36:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "CreateSnapshotResourceTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSnapshotRequestTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } } ] } }, "v2": { "createdDate": "2023-04-20T22:36:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:ModifyVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "CreateVolumeFromSnapshot", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ] }, { "Sid": "CreateSnapshotResourceTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSnapshotRequestTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } } ] } } }, "createdDate": "2023-04-20T22:36:00.000Z", "lastUpdatedDate": "2025-01-22T00:52:12.000Z" }, "ROSAIngressOperatorPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAIngressOperatorPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-20T22:37:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "route53:ListHostedZones", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.openshiftapps.com", "*.devshift.org", "*.openshiftusgov.com", "*.devshiftusgov.com" ] } } } ] } } }, "createdDate": "2023-04-20T22:37:08.000Z", "lastUpdatedDate": "2023-04-20T22:37:08.000Z" }, "ROSAControlPlaneOperatorPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAControlPlaneOperatorPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-24T23:02:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "route53:ListHostedZones" ], "Resource": "*" }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "ListResourceRecordSets", "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": [ "*" ] }, { "Sid": "ChangeResourceRecordSetsRestrictedRecordNames", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": [ "*" ], "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.hypershift.local" ] } } }, { "Sid": "VPCEndpointWithCondition", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "VPCEndpointNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "ManageVPCEndpointWithCondition", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "ModifyVPCEndpoingNoCondition", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpcEndpoint", "CreateSecurityGroup" ] } } } ] } }, "v2": { "createdDate": "2023-06-30T21:12:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "route53:ListHostedZones" ], "Resource": "*" }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "ListResourceRecordSets", "Effect": "Allow", "Action": [ "route53:ListResourceRecordSets" ], "Resource": [ "*" ] }, { "Sid": "ChangeResourceRecordSetsRestrictedRecordNames", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": [ "*" ], "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.hypershift.local" ] } } }, { "Sid": "VPCEndpointWithCondition", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "VPCEndpointResourceTagCondition", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "VPCEndpointNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*" ] }, { "Sid": "ManageVPCEndpointWithCondition", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "ModifyVPCEndpoingNoCondition", "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVpcEndpoint", "CreateSecurityGroup" ] } } } ] } } }, "createdDate": "2023-04-24T23:02:49.000Z", "lastUpdatedDate": "2023-06-30T21:12:32.000Z" }, "AmazonOpenSearchIngestionReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchIngestionReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-26T18:09:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "osis:GetPipeline", "osis:GetPipelineChangeProgress", "osis:GetPipelineBlueprint", "osis:ListPipelineBlueprints", "osis:ListPipelines", "osis:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2023-04-26T18:09:52.000Z", "lastUpdatedDate": "2023-04-26T18:09:52.000Z" }, "AmazonOpenSearchIngestionFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchIngestionFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-26T18:11:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "osis:CreatePipeline", "osis:UpdatePipeline", "osis:DeletePipeline", "osis:StartPipeline", "osis:StopPipeline", "osis:ListPipelines", "osis:GetPipeline", "osis:GetPipelineChangeProgress", "osis:ValidatePipeline", "osis:GetPipelineBlueprint", "osis:ListPipelineBlueprints", "osis:TagResource", "osis:UntagResource", "osis:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/osis.amazonaws.com/AWSServiceRoleForAmazonOpenSearchIngestionService", "Condition": { "StringLike": { "iam:AWSServiceName": "osis.amazonaws.com" } } } ] } } }, "createdDate": "2023-04-26T18:11:38.000Z", "lastUpdatedDate": "2023-04-26T18:11:38.000Z" }, "AWSWellArchitectedDiscoveryServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSWellArchitectedDiscoveryServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-26T18:36:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "trustedadvisor:DescribeChecks", "trustedadvisor:DescribeCheckItems" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "resource-groups:ListGroupResources", "tag:GetResources" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "servicecatalog:ListAssociatedResources", "servicecatalog:GetApplication", "servicecatalog:CreateAttributeGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "servicecatalog:AssociateAttributeGroup", "servicecatalog:DisassociateAttributeGroup" ], "Resource": [ "arn:*:servicecatalog:*:*:/applications/*", "arn:*:servicecatalog:*:*:/attribute-groups/AWS_WellArchitected-*" ] }, { "Effect": "Allow", "Action": [ "servicecatalog:UpdateAttributeGroup", "servicecatalog:DeleteAttributeGroup" ], "Resource": [ "arn:*:servicecatalog:*:*:/attribute-groups/AWS_WellArchitected-*" ] } ] } } }, "createdDate": "2023-04-26T18:36:40.000Z", "lastUpdatedDate": "2023-04-26T18:36:40.000Z" }, "ROSAKubeControllerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAKubeControllerPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-04-27T20:09:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes" ], "Resource": [ "*" ] }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "LoadBalanacerManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer" ], "Resource": [ "*" ] }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupVpc", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateLoadBalancer", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "ModifySecurityGroup", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTagsSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } } ] } }, "v2": { "createdDate": "2023-07-18T21:45:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeLoadBalancerPolicies" ], "Resource": [ "*" ] }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "LoadBalanacerManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer" ], "Resource": [ "*" ] }, { "Sid": "CreateTargetGroup", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateTargetGroup" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "LoadBalanacerManagementResourceTag", "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteListener", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateListeners", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateListener" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true", "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupVpc", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateLoadBalancer", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "ModifySecurityGroup", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTagsSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } } ] } }, "v3": { "createdDate": "2023-04-27T20:09:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeLoadBalancerPolicies" ], "Resource": [ "*" ] }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "LoadBalanacerManagement", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer" ], "Resource": [ "*" ] }, { "Sid": "CreateTargetGroup", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateTargetGroup" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "LoadBalanacerManagementResourceTag", "Effect": "Allow", "Action": [ "elasticloadbalancing:DeleteListener", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:DeleteLoadBalancerListeners", "elasticloadbalancing:AttachLoadBalancerToSubnets", "elasticloadbalancing:DetachLoadBalancerFromSubnets", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateListeners", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateListener" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true", "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupVpc", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateLoadBalancer", "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "ModifySecurityGroup", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTagsSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" } } } ] } } }, "createdDate": "2023-04-27T20:09:29.000Z", "lastUpdatedDate": "2023-10-16T18:17:05.000Z" }, "ROSAKMSProviderPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAKMSProviderPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-04-27T20:10:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "VolumeEncryption", "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } } ] } } }, "createdDate": "2023-04-27T20:10:20.000Z", "lastUpdatedDate": "2023-04-27T20:10:20.000Z" }, "ROSAImageRegistryOperatorPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAImageRegistryOperatorPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-04-27T20:13:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListBuckets", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" }, { "Sid": "AllowSpecificBucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketTagging", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetBucketLocation", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": [ "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*" ] }, { "Sid": "AllowSpecificObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*/*" ] } ] } }, "v2": { "createdDate": "2023-04-27T20:13:18.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListBuckets", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource": "*" }, { "Sid": "AllowSpecificBucketActions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketTagging", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetBucketLocation", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": [ "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*", "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}" ] }, { "Sid": "AllowSpecificObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*/*", "arn:aws:s3:::*-image-registry-${aws:RequestedRegion}/*" ] } ] } } }, "createdDate": "2023-04-27T20:13:18.000Z", "lastUpdatedDate": "2023-12-12T19:53:12.000Z" }, "AmazonVPCReachabilityAnalyzerPathComponentReadPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonVPCReachabilityAnalyzerPathComponentReadPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-05-01T20:38:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "NetworkFirewallPermissions", "Effect": "Allow", "Action": [ "network-firewall:Describe*", "network-firewall:List*" ], "Resource": "*" } ] } } }, "createdDate": "2023-05-01T20:38:22.000Z", "lastUpdatedDate": "2023-05-01T20:38:22.000Z" }, "KeyspacesReplicationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/KeyspacesReplicationServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-05-02T16:15:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select", "cassandra:SelectMultiRegionResource", "cassandra:Modify", "cassandra:ModifyMultiRegionResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-02T16:15:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "KeyspacesActionsNeededForSteadyStateReplication", "Effect": "Allow", "Action": [ "cassandra:Select", "cassandra:Modify", "cassandra:Alter", "cassandra:ModifyMultiRegionResource", "cassandra:SelectMultiRegionResource", "cassandra:AlterMultiRegionResource", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy" ], "Resource": "*" }, { "Sid": "CWDeleteAlarmPolicy", "Effect": "Allow", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking-*" }, { "Sid": "CWDescribeAlarmPolicy", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:*" }, { "Sid": "CWPutMetricAlarmPolicy", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking-*", "Condition": { "ForAllValues:StringLike": { "cloudwatch:AlarmActions": [ "arn:aws:autoscaling:*:*:scalingPolicy:*:resource/cassandra/keyspace/*/table/*:policyName/*:createdBy/*" ] } } } ] } } }, "createdDate": "2023-05-02T16:15:49.000Z", "lastUpdatedDate": "2024-11-15T20:55:16.000Z" }, "AmazonCodeGuruSecurityScanAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruSecurityScanAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-05-09T20:54:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruSecurityScanAccess", "Effect": "Allow", "Action": [ "codeguru-security:CreateScan", "codeguru-security:CreateUploadUrl", "codeguru-security:GetScan", "codeguru-security:GetFindings" ], "Resource": "arn:aws:codeguru-security:*:*:scans/*" } ] } } }, "createdDate": "2023-05-09T20:54:32.000Z", "lastUpdatedDate": "2023-05-09T20:54:32.000Z" }, "AmazonCodeGuruSecurityFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonCodeGuruSecurityFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-05-09T21:03:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonCodeGuruSecurityFullAccess", "Effect": "Allow", "Action": [ "codeguru-security:*" ], "Resource": "*" } ] } } }, "createdDate": "2023-05-09T21:03:38.000Z", "lastUpdatedDate": "2023-05-09T21:03:38.000Z" }, "AWSFinSpaceServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSFinSpaceServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-05-12T16:42:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/FinSpace" } }, "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-12T16:42:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSFinSpaceServiceRolePolicy", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/FinSpace", "AWS/Usage" ] } }, "Resource": "*" } ] } } }, "createdDate": "2023-05-12T16:42:03.000Z", "lastUpdatedDate": "2023-12-01T21:05:00.000Z" }, "AWSElasticDisasterRecoveryCrossAccountReplicationPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryCrossAccountReplicationPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-05-14T07:16:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeInstances", "drs:DescribeSourceServers", "drs:DescribeReplicationConfigurationTemplates", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } } ] } }, "v2": { "createdDate": "2023-05-14T07:16:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CrossAccountPolicy1", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeVolumeAttribute", "ec2:DescribeInstances", "drs:DescribeSourceServers", "drs:DescribeReplicationConfigurationTemplates", "drs:CreateSourceServerForDrs" ], "Resource": "*" }, { "Sid": "CrossAccountPolicy2", "Effect": "Allow", "Action": [ "drs:TagResource" ], "Resource": "arn:aws:drs:*:*:source-server/*", "Condition": { "StringEquals": { "drs:CreateAction": "CreateSourceServerForDrs" } } } ] } } }, "createdDate": "2023-05-14T07:16:47.000Z", "lastUpdatedDate": "2024-01-17T13:19:58.000Z" }, "AWSDMSServerlessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDMSServerlessServiceRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-05-18T20:28:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "id0", "Effect": "Allow", "Action": [ "dms:CreateReplicationInstance", "dms:CreateReplicationTask" ], "Resource": "*", "Condition": { "StringEquals": { "dms:req-tag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id1", "Effect": "Allow", "Action": [ "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks" ], "Resource": "*" }, { "Sid": "id2", "Effect": "Allow", "Action": [ "dms:StartReplicationTask", "dms:StopReplicationTask", "dms:DeleteReplicationTask", "dms:DeleteReplicationInstance" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:task:*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id3", "Effect": "Allow", "Action": [ "dms:TestConnection", "dms:DeleteConnection" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:endpoint:*" ] } ] } }, "v2": { "createdDate": "2023-05-18T20:28:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "id0", "Effect": "Allow", "Action": [ "dms:CreateReplicationInstance", "dms:CreateReplicationTask" ], "Resource": "*", "Condition": { "StringEquals": { "dms:req-tag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id1", "Effect": "Allow", "Action": [ "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks" ], "Resource": "*" }, { "Sid": "id2", "Effect": "Allow", "Action": [ "dms:StartReplicationTask", "dms:StopReplicationTask", "dms:ModifyReplicationTask", "dms:DeleteReplicationTask", "dms:ModifyReplicationInstance", "dms:DeleteReplicationInstance" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:task:*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id3", "Effect": "Allow", "Action": [ "dms:TestConnection", "dms:DeleteConnection" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:endpoint:*" ] } ] } }, "v3": { "createdDate": "2023-05-18T20:28:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "id0", "Effect": "Allow", "Action": [ "dms:CreateReplicationInstance", "dms:CreateReplicationTask" ], "Resource": "*", "Condition": { "StringEquals": { "dms:req-tag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id1", "Effect": "Allow", "Action": [ "dms:DescribeReplicationInstances", "dms:DescribeReplicationTasks" ], "Resource": "*" }, { "Sid": "id2", "Effect": "Allow", "Action": [ "dms:StartReplicationTask", "dms:StopReplicationTask", "dms:ModifyReplicationTask", "dms:DeleteReplicationTask", "dms:ModifyReplicationInstance", "dms:DeleteReplicationInstance" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:task:*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/ResourceCreatedBy": "DMSServerless" } } }, { "Sid": "id3", "Effect": "Allow", "Action": [ "dms:TestConnection", "dms:DeleteConnection" ], "Resource": [ "arn:aws:dms:*:*:rep:*", "arn:aws:dms:*:*:endpoint:*" ] }, { "Sid": "id4", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:DeleteObject", "s3:GetObject", "s3:PutObjectTagging" ], "Resource": [ "arn:aws:s3:::dms-serverless-premigration-results-*" ], "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "id5", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:ListBucket", "s3:GetBucketLocation", "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::dms-serverless-premigration-results-*" ], "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "id6", "Effect": "Allow", "Action": [ "dms:StartReplicationTaskAssessmentRun" ], "Resource": [ "*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/ResourceCreatedBy": "DMSServerless" } } } ] } } }, "createdDate": "2023-05-18T20:28:05.000Z", "lastUpdatedDate": "2025-02-07T17:52:06.000Z" }, "AmazonSecurityLakeAdministrator": { "arn": "arn:aws:iam::aws:policy/AmazonSecurityLakeAdministrator", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-05-30T22:04:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowActionsWithAnyResource", "Effect": "Allow", "Action": [ "securitylake:*", "organizations:DescribeOrganization", "organizations:ListDelegatedServicesForAccount", "organizations:ListAccounts", "iam:ListRoles", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "AllowActionsWithAnyResourceViaSecurityLake", "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:StopCrawlerSchedule", "lambda:CreateEventSourceMapping", "lakeformation:GrantPermissions", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:GetDatalakeSettings", "events:ListConnections", "events:ListApiDestinations", "iam:GetRole", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowManagingSecurityLakeS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration", "s3:PutBucketVersioning", "s3:PutReplicationConfiguration", "s3:PutLifecycleConfiguration", "s3:ListBucket", "s3:PutObject", "s3:GetBucketNotification" ], "Resource": "arn:aws:s3:::aws-security-data-lake*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowLambdaCreateFunction", "Effect": "Allow", "Action": "lambda:CreateFunction", "Resource": "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:CreateTable", "glue:GetTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowEventBridgeActions", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule", "events:CreateApiDestination", "events:CreateConnection", "events:UpdateConnection", "events:UpdateApiDestination", "events:DeleteConnection", "events:DeleteApiDestination", "events:ListTargetsByRule", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonSecurityLake*", "arn:aws:events:*:*:rule/SecurityLake*", "arn:aws:events:*:*:api-destination/AmazonSecurityLake*", "arn:aws:events:*:*:connection/AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowSQSActions", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:SetQueueAttributes", "sqs:GetQueueURL", "sqs:AddPermission", "sqs:GetQueueAttributes", "sqs:DeleteQueue" ], "Resource": [ "arn:aws:sqs:*:*:SecurityLake*", "arn:aws:sqs:*:*:AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowKmsCmkGrantForSecurityLake", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" }, "StringLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::aws-security-data-lake*" }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "GenerateDataKey", "RetireGrant" ] } } }, { "Sid": "AllowEnablingQueryBasedSubscribers", "Effect": "Allow", "Action": [ "ram:CreateResourceShare", "ram:AssociateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:ResourceArn": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowConfiguringQueryBasedSubscribers", "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:GetResourceShares", "ram:DisassociateResourceShare", "ram:DeleteResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "LakeFormation*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowConfiguringCredentialsForSubscriberNotification", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!connection/AmazonSecurityLake-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForUpdatingGluePartitionsSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForUpdatingGluePartitionsLambdaArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForCrossRegionReplicationSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition": { "StringEquals": { "iam:PassedToService": "s3.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForCrossRegionReplicationS3Arn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition": { "StringEquals": { "iam:PassedToService": "s3.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:s3:::aws-security-data-lake*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForCustomSourceCrawlerSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForCustomSourceCrawlerGlueArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForSubscriberNotificationSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition": { "StringEquals": { "iam:PassedToService": "events.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:subscriber/*" } } }, { "Sid": "AllowPassRoleForSubscriberNotificationEventsArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition": { "StringEquals": { "iam:PassedToService": "events.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:events:*:*:rule/AmazonSecurityLake*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowOnboardingToSecurityLakeDependencies", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/securitylake.amazonaws.com/AWSServiceRoleForSecurityLake", "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "securitylake.amazonaws.com", "lakeformation.amazonaws.com", "apidestinations.events.amazonaws.com" ] } } }, { "Sid": "AllowRolePolicyActionsforSubscibersandSources", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowRegisterS3LocationInLakeFormation", "Effect": "Allow", "Action": [ "iam:PutRolePolicy", "iam:GetRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowIAMActionsByResource", "Effect": "Allow", "Action": [ "iam:ListRolePolicies", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "S3ReadAccessToSecurityLakes", "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "arn:aws:s3:::aws-security-data-lake-*" }, { "Sid": "S3ResourcelessReadOnly", "Effect": "Allow", "Action": [ "s3:GetAccountPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-05-30T22:04:10.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowActionsWithAnyResource", "Effect": "Allow", "Action": [ "securitylake:*", "organizations:DescribeOrganization", "organizations:ListDelegatedServicesForAccount", "organizations:ListAccounts", "iam:ListRoles", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "AllowActionsWithAnyResourceViaSecurityLake", "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:StopCrawlerSchedule", "lambda:CreateEventSourceMapping", "lakeformation:GrantPermissions", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:GetDatalakeSettings", "events:ListConnections", "events:ListApiDestinations", "iam:GetRole", "iam:ListAttachedRolePolicies", "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowManagingSecurityLakeS3Buckets", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration", "s3:PutBucketVersioning", "s3:PutReplicationConfiguration", "s3:PutLifecycleConfiguration", "s3:ListBucket", "s3:PutObject", "s3:GetBucketNotification" ], "Resource": "arn:aws:s3:::aws-security-data-lake*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowLambdaCreateFunction", "Effect": "Allow", "Action": [ "lambda:CreateFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowLambdaAddPermission", "Effect": "Allow", "Action": [ "lambda:AddPermission" ], "Resource": [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" }, "StringEquals": { "lambda:Principal": "securitylake.amazonaws.com" } } }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:CreateTable", "glue:GetTable" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowEventBridgeActions", "Effect": "Allow", "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule", "events:CreateApiDestination", "events:CreateConnection", "events:UpdateConnection", "events:UpdateApiDestination", "events:DeleteConnection", "events:DeleteApiDestination", "events:ListTargetsByRule", "events:RemoveTargets", "events:DeleteRule" ], "Resource": [ "arn:aws:events:*:*:rule/AmazonSecurityLake*", "arn:aws:events:*:*:rule/SecurityLake*", "arn:aws:events:*:*:api-destination/AmazonSecurityLake*", "arn:aws:events:*:*:connection/AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowSQSActions", "Effect": "Allow", "Action": [ "sqs:CreateQueue", "sqs:SetQueueAttributes", "sqs:GetQueueURL", "sqs:AddPermission", "sqs:GetQueueAttributes", "sqs:DeleteQueue" ], "Resource": [ "arn:aws:sqs:*:*:SecurityLake*", "arn:aws:sqs:*:*:AmazonSecurityLake*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowKmsCmkGrantForSecurityLake", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" }, "StringLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::aws-security-data-lake*" }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "GenerateDataKey", "RetireGrant", "Decrypt" ] } } }, { "Sid": "AllowEnablingQueryBasedSubscribers", "Effect": "Allow", "Action": [ "ram:CreateResourceShare", "ram:AssociateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:ResourceArn": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowConfiguringQueryBasedSubscribers", "Effect": "Allow", "Action": [ "ram:UpdateResourceShare", "ram:GetResourceShares", "ram:DisassociateResourceShare", "ram:DeleteResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "LakeFormation*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowConfiguringCredentialsForSubscriberNotification", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:events!connection/AmazonSecurityLake-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForUpdatingGluePartitionsSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForUpdatingGluePartitionsLambdaArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForCrossRegionReplicationSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition": { "StringEquals": { "iam:PassedToService": "s3.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForCrossRegionReplicationS3Arn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition": { "StringEquals": { "iam:PassedToService": "s3.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:s3:::aws-security-data-lake*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForCustomSourceCrawlerSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid": "AllowPassRoleForCustomSourceCrawlerGlueArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowPassRoleForSubscriberNotificationSecLakeArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition": { "StringEquals": { "iam:PassedToService": "events.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:subscriber/*" } } }, { "Sid": "AllowPassRoleForSubscriberNotificationEventsArn", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition": { "StringEquals": { "iam:PassedToService": "events.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:events:*:*:rule/AmazonSecurityLake*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowOnboardingToSecurityLakeDependencies", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/securitylake.amazonaws.com/AWSServiceRoleForSecurityLake", "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations" ], "Condition": { "StringLike": { "iam:AWSServiceName": [ "securitylake.amazonaws.com", "lakeformation.amazonaws.com", "apidestinations.events.amazonaws.com" ] } } }, { "Sid": "AllowRolePolicyActionsforSubscibersandSources", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowRegisterS3LocationInLakeFormation", "Effect": "Allow", "Action": [ "iam:PutRolePolicy", "iam:GetRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "AllowIAMActionsByResource", "Effect": "Allow", "Action": [ "iam:ListRolePolicies", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "securitylake.amazonaws.com" } } }, { "Sid": "S3ReadAccessToSecurityLakes", "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "arn:aws:s3:::aws-security-data-lake-*" }, { "Sid": "S3ReadAccessToSecurityLakeMetastoreObject", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::security-lake-meta-store-manager-*" }, { "Sid": "S3ResourcelessReadOnly", "Effect": "Allow", "Action": [ "s3:GetAccountPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets" ], "Resource": "*" } ] } } }, "createdDate": "2023-05-30T22:04:10.000Z", "lastUpdatedDate": "2024-02-23T16:01:57.000Z" }, "ROSASRESupportPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSASRESupportPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-06-01T14:36:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "sts:DecodeAuthorizationMessage" ], "Resource": "*" }, { "Sid": "Route53", "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets" ], "Resource": [ "*" ] }, { "Sid": "DecribeIAMRoles", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "EC2DescribeInstance", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeReservedInstances", "ec2:DescribeScheduledInstances" ], "Resource": [ "*" ] }, { "Sid": "VPCNetwork", "Effect": "Allow", "Action": [ "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "Cloudtrail", "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents" ], "Resource": [ "*" ] }, { "Sid": "Cloudwatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": [ "*" ] }, { "Sid": "DescribeVolumes", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Sid": "DescribeLoadBalancers", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Sid": "DescribeVPC", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints" ], "Resource": [ "*" ] }, { "Sid": "DescribeSecurityGroups", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups" ], "Resource": "arn:aws:ec2:*:*:security-group*/*" }, { "Sid": "DescribeAddressesAttribute", "Effect": "Allow", "Action": "ec2:DescribeAddressesAttribute", "Resource": "arn:aws:ec2:*:*:elastic-ip/*" }, { "Sid": "DescribeInstance", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeSpotFleetInstances", "Effect": "Allow", "Action": "ec2:DescribeSpotFleetInstances", "Resource": "arn:aws:ec2:*:*:spot-fleet-request/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeVolumeAttribute", "Effect": "Allow", "Action": "ec2:DescribeVolumeAttribute", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "ManageInstanceLifecycle", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } }, "v2": { "createdDate": "2023-06-01T14:36:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "sts:DecodeAuthorizationMessage" ], "Resource": "*" }, { "Sid": "Route53", "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets" ], "Resource": [ "*" ] }, { "Sid": "DecribeIAMRoles", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "EC2DescribeInstance", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeReservedInstances", "ec2:DescribeScheduledInstances" ], "Resource": [ "*" ] }, { "Sid": "VPCNetwork", "Effect": "Allow", "Action": [ "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "Cloudtrail", "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents" ], "Resource": [ "*" ] }, { "Sid": "Cloudwatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": [ "*" ] }, { "Sid": "DescribeVolumes", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Sid": "DescribeLoadBalancers", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Sid": "DescribeVPC", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints" ], "Resource": [ "*" ] }, { "Sid": "DescribeSecurityGroups", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups" ], "Resource": "*" }, { "Sid": "DescribeAddressesAttribute", "Effect": "Allow", "Action": "ec2:DescribeAddressesAttribute", "Resource": "arn:aws:ec2:*:*:elastic-ip/*" }, { "Sid": "DescribeInstance", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeSpotFleetInstances", "Effect": "Allow", "Action": "ec2:DescribeSpotFleetInstances", "Resource": "arn:aws:ec2:*:*:spot-fleet-request/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeVolumeAttribute", "Effect": "Allow", "Action": "ec2:DescribeVolumeAttribute", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "ManageInstanceLifecycle", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } }, "v3": { "createdDate": "2023-06-01T14:36:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "sts:DecodeAuthorizationMessage" ], "Resource": "*" }, { "Sid": "Route53", "Effect": "Allow", "Action": [ "route53:GetHostedZone", "route53:GetHostedZoneCount", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets" ], "Resource": [ "*" ] }, { "Sid": "DecribeIAMRoles", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "EC2DescribeInstance", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeReservedInstances", "ec2:DescribeScheduledInstances" ], "Resource": [ "*" ] }, { "Sid": "VPCNetwork", "Effect": "Allow", "Action": [ "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "Cloudtrail", "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:LookupEvents" ], "Resource": [ "*" ] }, { "Sid": "Cloudwatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": [ "*" ] }, { "Sid": "DescribeVolumes", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DescribeVolumeStatus" ], "Resource": [ "*" ] }, { "Sid": "DescribeLoadBalancers", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": [ "*" ] }, { "Sid": "DescribeVPC", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints" ], "Resource": [ "*" ] }, { "Sid": "DescribeSecurityGroups", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups" ], "Resource": "*" }, { "Sid": "DescribeAddressesAttribute", "Effect": "Allow", "Action": "ec2:DescribeAddressesAttribute", "Resource": "arn:aws:ec2:*:*:elastic-ip/*" }, { "Sid": "DescribeInstance", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeSpotFleetInstances", "Effect": "Allow", "Action": "ec2:DescribeSpotFleetInstances", "Resource": "arn:aws:ec2:*:*:spot-fleet-request/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "DescribeVolumeAttribute", "Effect": "Allow", "Action": "ec2:DescribeVolumeAttribute", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "ManageInstanceLifecycle", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } } }, "createdDate": "2023-06-01T14:36:06.000Z", "lastUpdatedDate": "2024-04-10T20:51:37.000Z" }, "AmazonDocDBElasticFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDocDBElasticFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2023-06-21T18:05:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones", "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ], "aws:ResourceTag/DocDBElasticFullAccess": "*" } } }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/DocDBElasticFullAccess": "*", "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecretVersionIds", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/DocDBElasticFullAccess": "*" }, "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } }, "v1": { "createdDate": "2023-06-05T13:51:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones", "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ], "aws:ResourceTag/DocDBElasticFullAccess": "*" } } }, { "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/DocDBElasticFullAccess": "*", "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Effect": "Allow", "Action": [ "secretsmanager:ListSecretVersionIds", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/DocDBElasticFullAccess": "*" }, "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2023-06-05T13:51:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DocdbElasticSid", "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource", "docdb-elastic:CopyClusterSnapshot", "docdb-elastic:StartCluster", "docdb-elastic:StopCluster" ], "Resource": [ "*" ] }, { "Sid": "EC2Sid", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones", "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Sid": "KMSSid", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ], "aws:ResourceTag/DocDBElasticFullAccess": "*" } } }, { "Sid": "KMSGrantSid", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/DocDBElasticFullAccess": "*", "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "SecretManagerSid", "Effect": "Allow", "Action": [ "secretsmanager:ListSecretVersionIds", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/DocDBElasticFullAccess": "*" }, "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Sid": "CloudwatchSid", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics" ], "Resource": [ "*" ] }, { "Sid": "SLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2023-06-05T13:51:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DocdbElasticSid", "Effect": "Allow", "Action": [ "docdb-elastic:CreateCluster", "docdb-elastic:UpdateCluster", "docdb-elastic:GetCluster", "docdb-elastic:DeleteCluster", "docdb-elastic:ListClusters", "docdb-elastic:CreateClusterSnapshot", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:DeleteClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:RestoreClusterFromSnapshot", "docdb-elastic:TagResource", "docdb-elastic:UntagResource", "docdb-elastic:ListTagsForResource", "docdb-elastic:CopyClusterSnapshot", "docdb-elastic:StartCluster", "docdb-elastic:StopCluster", "docdb-elastic:GetPendingMaintenanceAction", "docdb-elastic:ListPendingMaintenanceActions", "docdb-elastic:ApplyPendingMaintenanceAction" ], "Resource": [ "*" ] }, { "Sid": "EC2Sid", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:DescribeVpcEndpoints", "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones", "secretsmanager:ListSecrets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Sid": "KMSSid", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ], "aws:ResourceTag/DocDBElasticFullAccess": "*" } } }, { "Sid": "KMSGrantSid", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/DocDBElasticFullAccess": "*", "kms:ViaService": [ "docdb-elastic.*.amazonaws.com" ] }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "SecretManagerSid", "Effect": "Allow", "Action": [ "secretsmanager:ListSecretVersionIds", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/DocDBElasticFullAccess": "*" }, "StringEquals": { "aws:CalledViaFirst": "docdb-elastic.amazonaws.com" } } }, { "Sid": "CloudwatchSid", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics" ], "Resource": [ "*" ] }, { "Sid": "SLRSid", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/docdb-elastic.amazonaws.com/AWSServiceRoleForDocDB-Elastic", "Condition": { "StringLike": { "iam:AWSServiceName": "docdb-elastic.amazonaws.com" } } } ] } } }, "createdDate": "2023-06-05T13:51:04.000Z", "lastUpdatedDate": "2025-02-11T18:22:06.000Z" }, "AWSControlTowerAccountServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSControlTowerAccountServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-05T22:04:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPutRuleOnSpecificSourcesAndDetailTypes", "Effect": "Allow", "Action": "events:PutRule", "Resource": "arn:aws:events:*:*:rule/*ControlTower*", "Condition": { "ForAnyValue:StringEquals": { "events:source": "aws.securityhub" }, "Null": { "events:detail-type": "false" }, "StringEquals": { "events:ManagedBy": "controltower.amazonaws.com", "events:detail-type": "Security Hub Findings - Imported" } } }, { "Sid": "AllowOtherOperationsOnRulesManagedByControlTower", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:EnableRule", "events:DisableRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "arn:aws:events:*:*:rule/*ControlTower*", "Condition": { "StringEquals": { "events:ManagedBy": "controltower.amazonaws.com" } } }, { "Sid": "AllowDescribeOperationsOnRulesManagedByControlTower", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "arn:aws:events:*:*:rule/*ControlTower*" }, { "Sid": "AllowControlTowerToPublishSecurityNotifications", "Effect": "Allow", "Action": "sns:publish", "Resource": "arn:aws:sns:*:*:aws-controltower-AggregateSecurityNotifications", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } }, { "Sid": "AllowActionsForSecurityHubIntegration", "Effect": "Allow", "Action": [ "securityhub:DescribeStandardsControls", "securityhub:GetEnabledStandards" ], "Resource": "arn:aws:securityhub:*:*:hub/default" } ] } } }, "createdDate": "2023-06-05T22:04:50.000Z", "lastUpdatedDate": "2023-06-05T22:04:50.000Z" }, "ROSAInstallerPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSAInstallerPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-06-06T21:00:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeInstanceTypeOfferings", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeLoadBalancers", "iam:GetRole", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53:GetAccountLimit", "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "PassRoleToEC2", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "ManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid": "CreateInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "GetSecretValue", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "Route53ManageRecords", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.openshiftapps.com", "*.devshift.org", "*.hypershift.local", "*.openshiftusgov.com", "*.devshiftusgov.com" ] } } }, { "Sid": "Route53Manage", "Effect": "Allow", "Action": [ "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:DeleteHostedZone" ], "Resource": "*" }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Sid": "RunInstancesRestrictedRequestTag", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRedHatOwnedAMIs", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid": "ManageInstancesRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:GetConsoleOutput" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateGrantRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup" ] } } } ] } }, "v2": { "createdDate": "2023-06-06T21:00:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeInstanceTypeOfferings", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeLoadBalancers", "iam:GetOpenIDConnectProvider", "iam:GetRole", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:GetAccountLimit", "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "PassRoleToEC2", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "ManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid": "CreateInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "GetSecretValue", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "Route53ManageRecords", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.openshiftapps.com", "*.devshift.org", "*.hypershift.local", "*.openshiftusgov.com", "*.devshiftusgov.com" ] } } }, { "Sid": "Route53Manage", "Effect": "Allow", "Action": [ "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:DeleteHostedZone" ], "Resource": "*" }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Sid": "RunInstancesRestrictedRequestTag", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRedHatOwnedAMIs", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid": "ManageInstancesRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:GetConsoleOutput" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateGrantRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup" ] } } } ] } }, "v3": { "createdDate": "2023-06-06T21:00:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeInstanceTypeOfferings", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeLoadBalancers", "iam:GetOpenIDConnectProvider", "iam:GetRole", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:GetAccountLimit", "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "PassRoleToEC2", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "ManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid": "CreateInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "GetSecretValue", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "Route53ManageRecords", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.openshiftapps.com", "*.devshift.org", "*.hypershift.local", "*.openshiftusgov.com", "*.devshiftusgov.com" ] } } }, { "Sid": "Route53Manage", "Effect": "Allow", "Action": [ "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:DeleteHostedZone" ], "Resource": "*" }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Sid": "RunInstancesRestrictedRequestTag", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRedHatOwnedAMIs", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid": "ManageInstancesRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:GetConsoleOutput" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateGrantRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup" ] } } }, { "Sid": "ListPoliciesAttachedToRoles", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } }, "v4": { "createdDate": "2023-06-06T21:00:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeRegions", "ec2:DescribeReservedInstancesOfferings", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeInstanceTypeOfferings", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:DescribeLoadBalancers", "iam:GetOpenIDConnectProvider", "iam:GetRole", "route53:GetHostedZone", "route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:ListResourceRecordSets", "route53:GetAccountLimit", "servicequotas:GetServiceQuota" ], "Resource": "*" }, { "Sid": "PassRoleToEC2", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "ManageInstanceProfiles", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid": "CreateInstanceProfiles", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "GetSecretValue", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "Route53ManageRecords", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "route53:ChangeResourceRecordSetsNormalizedRecordNames": [ "*.openshiftapps.com", "*.devshift.org", "*.hypershift.local", "*.openshiftusgov.com", "*.devshiftusgov.com" ] } } }, { "Sid": "Route53Manage", "Effect": "Allow", "Action": [ "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:DeleteHostedZone" ], "Resource": "*" }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:snapshot/*" ] }, { "Sid": "RunInstancesRestrictedRequestTag", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRedHatOwnedAMIs", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid": "ManageInstancesRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:TerminateInstances", "ec2:GetConsoleOutput" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateGrantRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": true } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateSecurityGroups", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "DeleteSecurityGroup", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "SecurityGroupIngressEgress", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group*/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateSecurityGroupsVPCNoCondition", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "CreateTagsRestrictedActions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup" ] } } }, { "Sid": "CreateTagsK8sSubnet", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "kubernetes.io/cluster/*" ] } } }, { "Sid": "ListPoliciesAttachedToRoles", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } } ] } } }, "createdDate": "2023-06-06T21:00:31.000Z", "lastUpdatedDate": "2024-04-24T19:49:55.000Z" }, "AmazonDocDBElasticReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDocDBElasticReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-06-08T14:37:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "docdb-elastic:ListClusters", "docdb-elastic:GetCluster", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-06-21T16:57:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "docdb-elastic:ListClusters", "docdb-elastic:GetCluster", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-08T14:37:37.000Z", "lastUpdatedDate": "2023-06-21T16:57:09.000Z" }, "ROSANodePoolManagementPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/ROSANodePoolManagementPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-06-08T20:48:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing" ], "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } }, { "Sid": "PassWorkerRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "AuthorizeSecurityGroupIngressRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:security-group-rule/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "NetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "NetworkInterfacesNoCondition", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "TerminateInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "CreateTagsCAPAControllerReconcileInstance", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTagsCAPAControllerReconcileVolume", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRequest", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "RunInstancesRedHatAMI", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822" ] } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateGrantRestricted", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-06-08T20:48:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": [ "*" ] }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing" ], "Condition": { "StringLike": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } }, { "Sid": "PassWorkerRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:*:iam::*:role/*-ROSA-Worker-Role" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "AuthorizeSecurityGroupIngressRestrictedResourceTag", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:security-group-rule/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "NetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "NetworkInterfacesNoCondition", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "TerminateInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances" ] } } }, { "Sid": "CreateTagsCAPAControllerReconcileInstance", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/red-hat-managed": "true" } } }, { "Sid": "CreateTagsCAPAControllerReconcileVolume", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesRequest", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/red-hat-managed": "true" } } }, { "Sid": "RunInstancesNoCondition", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "RunInstancesRedHatAMI", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:Owner": [ "531415883065", "251351625822" ] } } }, { "Sid": "ManagedKMSRestrictedResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/red-hat": "true" } } }, { "Sid": "CreateGrantRestricted", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true }, "StringEquals": { "aws:ResourceTag/red-hat": "true" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" } } } ] } } }, "createdDate": "2023-06-08T20:48:08.000Z", "lastUpdatedDate": "2024-05-02T14:01:47.000Z" }, "AWSElasticDisasterRecoveryNetworkReplicationPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSElasticDisasterRecoveryNetworkReplicationPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-06-11T12:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-06-11T12:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSNetworkReplicationPolicy1", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-11T12:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSNetworkReplicationPolicy1", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-06-11T12:36:48.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DRSNetworkReplicationPolicy1", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeInstances", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:GetManagedPrefixListAssociations" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-11T12:36:48.000Z", "lastUpdatedDate": "2024-01-02T13:25:23.000Z" }, "AmazonVPCReachabilityAnalyzerFullAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonVPCReachabilityAnalyzerFullAccessPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-06-14T20:12:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsPath", "ec2:DeleteNetworkInsightsAnalysis", "ec2:DeleteNetworkInsightsPath", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-path/nip-*", "arn:*:ec2:*:*:network-insights-analysis/nia-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-06-14T20:12:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsPath", "ec2:DeleteNetworkInsightsAnalysis", "ec2:DeleteNetworkInsightsPath", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-path/*", "arn:*:ec2:*:*:network-insights-analysis/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-14T20:12:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DirectconnectPermissions", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsPath", "ec2:DeleteNetworkInsightsAnalysis", "ec2:DeleteNetworkInsightsPath", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAnalyses", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAnalysis" ], "Resource": "*" }, { "Sid": "EC2TagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-path/*", "arn:*:ec2:*:*:network-insights-analysis/*" ] }, { "Sid": "ElasticloadbalancingPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Sid": "GlobalacceleratorPermissions", "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Sid": "NetworkFirewallPermissions", "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Sid": "TirosPermissions", "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:ExtendQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation", "tiros:GetQueryExtensionAccounts" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-14T20:12:17.000Z", "lastUpdatedDate": "2024-05-15T20:47:28.000Z" }, "AmazonMacieReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonMacieReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-15T21:50:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "macie2:Describe*", "macie2:Get*", "macie2:List*", "macie2:BatchGetCustomDataIdentifiers", "macie2:SearchResources" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-15T21:50:06.000Z", "lastUpdatedDate": "2023-06-15T21:50:06.000Z" }, "AmazonVPCNetworkAccessAnalyzerFullAccessPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonVPCNetworkAccessAnalyzerFullAccessPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-06-15T22:56:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScopeAnalysis", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAccessScopeAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-access-scope/nis-*", "arn:*:ec2:*:*:network-insights-access-scope-analysis/nisa-*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-06-15T22:56:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScopeAnalysis", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAccessScopeAnalysis" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-access-scope/*", "arn:*:ec2:*:*:network-insights-access-scope-analysis/*" ] }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-06-15T22:56:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DirectconnectPermissions", "Effect": "Allow", "Action": [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces" ], "Resource": "*" }, { "Sid": "EC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScope", "ec2:DeleteNetworkInsightsAccessScopeAnalysis", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeAnalysisFindings", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "ec2:StartNetworkInsightsAccessScopeAnalysis" ], "Resource": "*" }, { "Sid": "EC2TagsPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:*:ec2:*:*:network-insights-access-scope/*", "arn:*:ec2:*:*:network-insights-access-scope-analysis/*" ] }, { "Sid": "ElasticloadbalancingPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource": "*" }, { "Sid": "GlobalacceleratorPermissions", "Effect": "Allow", "Action": [ "globalaccelerator:ListAccelerators", "globalaccelerator:ListCustomRoutingAccelerators", "globalaccelerator:ListCustomRoutingEndpointGroups", "globalaccelerator:ListCustomRoutingListeners", "globalaccelerator:ListCustomRoutingPortMappings", "globalaccelerator:ListEndpointGroups", "globalaccelerator:ListListeners" ], "Resource": "*" }, { "Sid": "NetworkFirewallPermissions", "Effect": "Allow", "Action": [ "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups" ], "Resource": "*" }, { "Sid": "ResourceGroupsPermissions", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "TagsPermissions", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": "*" }, { "Sid": "TirosPermissions", "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-15T22:56:58.000Z", "lastUpdatedDate": "2024-05-15T21:40:54.000Z" }, "EMRDescribeClusterPolicyForEMRWAL": { "arn": "arn:aws:iam::aws:policy/aws-service-role/EMRDescribeClusterPolicyForEMRWAL", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-15T23:30:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-15T23:30:22.000Z", "lastUpdatedDate": "2023-06-15T23:30:22.000Z" }, "AWSAppFabricServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAppFabricServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-26T21:07:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchEmitMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AppFabric" } } }, { "Sid": "S3PutObject", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::*/AWSAppFabric/*", "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FirehosePutRecord", "Effect": "Allow", "Action": [ "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/*", "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/AWSAppFabricManaged": "true" } } } ] } } }, "createdDate": "2023-06-26T21:07:45.000Z", "lastUpdatedDate": "2023-06-26T21:07:45.000Z" }, "AWSResilienceHubAsssessmentExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSResilienceHubAsssessmentExecutionPolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeGlobalClusters", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "s3:GetBucketLocation", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v2": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "s3:GetBucketLocation", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*" }, { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v3": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSResilienceHubFullResourceStatement", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "s3:GetBucketLocation", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "states:DescribeStateMachine", "states:ListStateMachineVersions", "states:ListStateMachineAliases", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AWSResilienceHubApiGatewayStatement", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Sid": "AWSResilienceHubS3Statement", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*" }, { "Sid": "AWSResilienceHubCloudWatchStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Sid": "AWSResilienceHubSSMStatement", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v4": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSResilienceHubFullResourceStatement", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "datasync:DescribeTask", "datasync:ListLocations", "datasync:ListTasks", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "fsx:DescribeFileSystems", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "states:DescribeStateMachine", "states:ListStateMachineVersions", "states:ListStateMachineAliases", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AWSResilienceHubApiGatewayStatement", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Sid": "AWSResilienceHubS3Statement", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*" }, { "Sid": "AWSResilienceHubCloudWatchStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Sid": "AWSResilienceHubSSMStatement", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v5": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSResilienceHubFullResourceStatement", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "datasync:DescribeTask", "datasync:ListLocations", "datasync:ListTasks", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "docdb-elastic:GetCluster", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:ListTagsForResource", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "fsx:DescribeFileSystems", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:ListFunctionEventInvokeConfigs", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "rds:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:ListBucket", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "states:DescribeStateMachine", "states:ListStateMachineVersions", "states:ListStateMachineAliases", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AWSResilienceHubApiGatewayStatement", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Sid": "AWSResilienceHubS3ArtifactStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubS3AccessStatement", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubCloudWatchStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Sid": "AWSResilienceHubSSMStatement", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v6": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSResilienceHubFullResourceStatement", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "datasync:DescribeTask", "datasync:ListLocations", "datasync:ListTasks", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "docdb-elastic:GetCluster", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:ListTagsForResource", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeServerlessCaches", "elasticache:DescribeServerlessCacheSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "fsx:DescribeFileSystems", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:ListFunctionEventInvokeConfigs", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "rds:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:ListBucket", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "states:DescribeStateMachine", "states:ListStateMachineVersions", "states:ListStateMachineAliases", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AWSResilienceHubApiGatewayStatement", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Sid": "AWSResilienceHubS3ArtifactStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubS3AccessStatement", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubCloudWatchStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Sid": "AWSResilienceHubSSMStatement", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } }, "v7": { "createdDate": "2023-06-27T12:32:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSResilienceHubFullResourceStatement", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "autoscaling:DescribeAutoScalingGroups", "backup:DescribeBackupVault", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:ListBackupPlans", "backup:ListBackupSelections", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:ValidateTemplate", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "datasync:DescribeTask", "datasync:ListLocations", "datasync:ListTasks", "devops-guru:ListMonitoredResources", "dlm:GetLifecyclePolicies", "dlm:GetLifecyclePolicy", "docdb-elastic:GetCluster", "docdb-elastic:GetClusterSnapshot", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:ListTagsForResource", "drs:DescribeJobs", "drs:DescribeSourceServers", "drs:GetReplicationConfiguration", "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeLimits", "dynamodb:DescribeTable", "dynamodb:ListGlobalTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAvailabilityZones", "ec2:DescribeFastSnapshotRestores", "ec2:DescribeFleets", "ec2:DescribeHosts", "ec2:DescribeInstances", "ec2:DescribeNatGateways", "ec2:DescribePlacementGroups", "ec2:DescribeRegions", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVpcEndpoints", "ecr:DescribeRegistry", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:ListContainerInstances", "ecs:ListServices", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListFargateProfiles", "eks:ListNodegroups", "elasticache:DescribeCacheClusters", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeSnapshots", "elasticache:DescribeServerlessCaches", "elasticache:DescribeServerlessCacheSnapshots", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeReplicationConfigurations", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "fis:GetExperiment", "fis:GetExperimentTemplate", "fis:ListExperimentTemplates", "fis:ListExperiments", "fis:ListExperimentResolvedTargets", "fsx:DescribeFileSystems", "lambda:GetFunctionConcurrency", "lambda:GetFunctionConfiguration", "lambda:ListAliases", "lambda:ListEventSourceMappings", "lambda:ListFunctionEventInvokeConfigs", "lambda:ListVersionsByFunction", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBInstances", "rds:DescribeDBProxies", "rds:DescribeDBProxyTargets", "rds:DescribeDBSnapshots", "rds:DescribeGlobalClusters", "rds:ListTagsForResource", "resource-groups:GetGroup", "resource-groups:ListGroupResources", "route53-recovery-control-config:ListClusters", "route53-recovery-control-config:ListControlPanels", "route53-recovery-control-config:ListRoutingControls", "route53-recovery-readiness:GetReadinessCheckStatus", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:ListReadinessChecks", "route53:GetHealthCheck", "route53:ListHealthChecks", "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53resolver:ListResolverEndpoints", "route53resolver:ListResolverEndpointIpAddresses", "s3:ListBucket", "servicecatalog:GetApplication", "servicecatalog:ListAssociatedResources", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "ssm:DescribeAutomationExecutions", "states:DescribeStateMachine", "states:ListStateMachineVersions", "states:ListStateMachineAliases", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AWSResilienceHubApiGatewayStatement", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans" ] }, { "Sid": "AWSResilienceHubS3ArtifactStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubS3AccessStatement", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketPolicyStatus", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetMultiRegionAccessPointRoutes", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AWSResilienceHubCloudWatchStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "ResilienceHub" } } }, { "Sid": "AWSResilienceHubSSMStatement", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*:*:parameter/ResilienceHub/*" } ] } } }, "createdDate": "2023-06-27T12:32:15.000Z", "lastUpdatedDate": "2024-12-16T14:40:07.000Z" }, "AWSAppFabricFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppFabricFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-27T19:51:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appfabric:*" ], "Resource": "*" }, { "Sid": "KMSListAccess", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Sid": "S3ReadAccess", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "FirehoseReadAccess", "Effect": "Allow", "Action": [ "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams" ], "Resource": "*" }, { "Sid": "AllowUseOfServiceLinkedRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "appfabric.amazonaws.com" } }, "Resource": "arn:aws:iam::*:role/aws-service-role/appfabric.amazonaws.com/AWSServiceRoleForAppFabric" } ] } } }, "createdDate": "2023-06-27T19:51:17.000Z", "lastUpdatedDate": "2023-06-27T19:51:17.000Z" }, "AWSAppFabricReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSAppFabricReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-06-27T19:52:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "appfabric:GetAppAuthorization", "appfabric:GetAppBundle", "appfabric:GetIngestion", "appfabric:GetIngestionDestination", "appfabric:ListAppAuthorizations", "appfabric:ListAppBundles", "appfabric:ListIngestionDestinations", "appfabric:ListIngestions", "appfabric:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2023-06-27T19:52:02.000Z", "lastUpdatedDate": "2023-06-27T19:52:02.000Z" }, "AmazonCognitoUnAuthedIdentitiesSessionPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonCognitoUnAuthedIdentitiesSessionPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-07-19T23:04:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rum:PutRumEvents", "sagemaker:InvokeEndpoint", "polly:*", "comprehend:*", "translate:*", "transcribe:*", "rekognition:*", "mobiletargeting:*", "firehose:*", "personalize:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-07-19T23:04:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CognitoUnAuthedIdentitiesSessionPolicy", "Effect": "Allow", "Action": [ "rum:PutRumEvents", "sagemaker:InvokeEndpoint", "polly:*", "comprehend:*", "translate:*", "transcribe:*", "rekognition:*", "mobiletargeting:*", "firehose:*", "personalize:*", "geo:GetMap*", "geo:SearchPlaceIndex*", "geo:GetPlace", "geo:CalculateRoute*", "geo:*Geofence", "geo:*Geofences", "geo:*DevicePosition*" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-07-19T23:04:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CognitoUnAuthedIdentitiesSessionPolicy", "Effect": "Allow", "Action": [ "rum:PutRumEvents", "sagemaker:InvokeEndpoint", "polly:*", "comprehend:*", "translate:*", "transcribe:*", "rekognition:*", "mobiletargeting:*", "firehose:*", "personalize:*", "geo:GetMap*", "geo:SearchPlaceIndex*", "geo:GetPlace", "geo:CalculateRoute*", "geo:*Geofence", "geo:*Geofences", "geo:*DevicePosition*", "kms:Encrypt", "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey", "kms:GenerateDataKeyPair", "kms:GenerateDataKeyPairWithoutPlaintext", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" } ] } } }, "createdDate": "2023-07-19T23:04:05.000Z", "lastUpdatedDate": "2024-11-01T18:12:44.000Z" }, "AmazonEFSCSIDriverPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-07-25T20:10:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowDescribe", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "AllowCreateAccessPoint", "Effect": "Allow", "Action": [ "elasticfilesystem:CreateAccessPoint" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/efs.csi.aws.com/cluster": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": "efs.csi.aws.com/cluster" } } }, { "Sid": "AllowTagNewAccessPoints", "Effect": "Allow", "Action": [ "elasticfilesystem:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "elasticfilesystem:CreateAction": "CreateAccessPoint" }, "Null": { "aws:RequestTag/efs.csi.aws.com/cluster": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": "efs.csi.aws.com/cluster" } } }, { "Sid": "AllowDeleteAccessPoint", "Effect": "Allow", "Action": "elasticfilesystem:DeleteAccessPoint", "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/efs.csi.aws.com/cluster": "false" } } } ] } } }, "createdDate": "2023-07-25T20:10:04.000Z", "lastUpdatedDate": "2023-07-25T20:10:04.000Z" }, "AWSElementalMediaPackageV2FullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaPackageV2FullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-07-25T20:29:37.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "mediapackagev2:*", "Resource": "*" } } } }, "createdDate": "2023-07-25T20:29:37.000Z", "lastUpdatedDate": "2023-07-25T20:29:37.000Z" }, "AWSElementalMediaPackageV2ReadOnly": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaPackageV2ReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-07-25T20:31:25.000Z", "document": { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": [ "mediapackagev2:List*", "mediapackagev2:Get*" ], "Resource": "*" } } } }, "createdDate": "2023-07-25T20:31:25.000Z", "lastUpdatedDate": "2023-07-25T20:31:25.000Z" }, "AWSHealthImagingFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSHealthImagingFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-07-25T23:39:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "medical-imaging:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "medical-imaging.amazonaws.com" } } } ] } } }, "createdDate": "2023-07-25T23:39:40.000Z", "lastUpdatedDate": "2023-07-25T23:39:40.000Z" }, "AWSHealthImagingReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSHealthImagingReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-07-25T23:40:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "medical-imaging:GetDICOMImportJob", "medical-imaging:GetDatastore", "medical-imaging:GetImageFrame", "medical-imaging:GetImageSet", "medical-imaging:GetImageSetMetadata", "medical-imaging:ListDICOMImportJobs", "medical-imaging:ListDatastores", "medical-imaging:ListImageSetVersions", "medical-imaging:SearchImageSets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-08-01T15:18:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "medical-imaging:GetDICOMImportJob", "medical-imaging:GetDatastore", "medical-imaging:GetImageFrame", "medical-imaging:GetImageSet", "medical-imaging:GetImageSetMetadata", "medical-imaging:ListDICOMImportJobs", "medical-imaging:ListDatastores", "medical-imaging:ListImageSetVersions", "medical-imaging:ListTagsForResource", "medical-imaging:SearchImageSets" ], "Resource": "*" } ] } } }, "createdDate": "2023-07-25T23:40:40.000Z", "lastUpdatedDate": "2023-08-01T15:18:49.000Z" }, "CloudWatchFullAccessV2": { "arn": "arn:aws:iam::aws:policy/CloudWatchFullAccessV2", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-08-01T11:32:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchFullAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "cloudwatch:*", "logs:*", "sns:CreateTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "oam:ListSinks" ], "Resource": "*" }, { "Sid": "EventsServicePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v2": { "createdDate": "2023-08-01T11:32:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchFullAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "cloudwatch:*", "logs:*", "sns:CreateTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "oam:ListSinks", "rum:*", "synthetics:*", "xray:*" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals", "Condition": { "StringLike": { "iam:AWSServiceName": "application-signals.cloudwatch.amazonaws.com" } } }, { "Sid": "EventsServicePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } }, "v3": { "createdDate": "2023-08-01T11:32:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchFullAccessPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalingPolicies", "application-signals:*", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribePolicies", "cloudwatch:*", "logs:*", "sns:CreateTopic", "sns:ListSubscriptions", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:Subscribe", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "oam:ListSinks", "rum:*", "synthetics:*", "xray:*" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals", "Condition": { "StringLike": { "iam:AWSServiceName": "application-signals.cloudwatch.amazonaws.com" } } }, { "Sid": "EventsServicePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*", "Condition": { "StringLike": { "iam:AWSServiceName": "events.amazonaws.com" } } }, { "Sid": "OAMReadPermissions", "Effect": "Allow", "Action": [ "oam:ListAttachedLinks" ], "Resource": "arn:aws:oam:*:*:sink/*" } ] } } }, "createdDate": "2023-08-01T11:32:57.000Z", "lastUpdatedDate": "2024-05-17T22:20:49.000Z" }, "AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-01T15:05:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:partner": false }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-08-01T15:05:51.000Z", "lastUpdatedDate": "2023-08-01T15:05:51.000Z" }, "AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-01T15:06:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "sagemaker:InvokeEndpoint", "Resource": "arn:aws:sagemaker:*:*:endpoint/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-08-01T15:06:24.000Z", "lastUpdatedDate": "2023-08-01T15:06:24.000Z" }, "AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-01T15:06:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsApiGatewayRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "apigateway.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:ListTags", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "lambda:PublishLayerVersion", "lambda:GetLayerVersion", "lambda:DeleteLayerVersion", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:layer:sagemaker-*", "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*/lambda-auth-code/layer.zip" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-08-01T15:06:46.000Z", "lastUpdatedDate": "2023-08-01T15:06:46.000Z" }, "AWSMigrationHubRefactorSpaces-SSMAutomationPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AWSMigrationHubRefactorSpaces-SSMAutomationPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-10T15:08:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/refactor-spaces:ssm:optin": "true" } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyInstanceAttribute" ], "Resource": "arn:aws:ec2:*:*:security-group/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceTag/refactor-spaces:ssm:optin": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": "refactor-spaces:ssm:environment-id" } } }, { "Effect": "Allow", "Action": "ssm:GetParameters", "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*" } ] } } }, "createdDate": "2023-08-10T15:08:14.000Z", "lastUpdatedDate": "2023-08-10T15:08:14.000Z" }, "AmazonRDSPerformanceInsightsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-08-15T23:41:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics" ], "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Effect": "Allow", "Action": [ "pi:CreatePerformanceAnalysisReport", "pi:GetPerformanceAnalysisReport", "pi:ListPerformanceAnalysisReports", "pi:DeletePerformanceAnalysisReport" ], "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Effect": "Allow", "Action": [ "pi:TagResource", "pi:UntagResource", "pi:ListTagsForResource" ], "Resource": "arn:aws:pi:*:*:*/rds/*" }, { "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-08-15T23:41:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRDSPerformanceInsightsReadAccess", "Effect": "Allow", "Action": [ "pi:DescribeDimensionKeys", "pi:GetDimensionKeyDetails", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics" ], "Resource": "arn:aws:pi:*:*:metrics/rds/*" }, { "Sid": "AmazonRDSPerformanceInsightsAnalisysReportFullAccess", "Effect": "Allow", "Action": [ "pi:CreatePerformanceAnalysisReport", "pi:GetPerformanceAnalysisReport", "pi:ListPerformanceAnalysisReports", "pi:DeletePerformanceAnalysisReport" ], "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*" }, { "Sid": "AmazonRDSPerformanceInsightsTaggingFullAccess", "Effect": "Allow", "Action": [ "pi:TagResource", "pi:UntagResource", "pi:ListTagsForResource" ], "Resource": "arn:aws:pi:*:*:*/rds/*" }, { "Sid": "AmazonRDSDescribeInstanceAccess", "Effect": "Allow", "Action": [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource": "*" }, { "Sid": "AmazonCloudWatchReadAccess", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData" ], "Resource": "*" } ] } } }, "createdDate": "2023-08-15T23:41:34.000Z", "lastUpdatedDate": "2023-10-23T21:14:27.000Z" }, "AWSEntityResolutionConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSEntityResolutionConsoleFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-08-17T17:54:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EntityResolutionAccess", "Effect": "Allow", "Action": [ "entityresolution:*" ], "Resource": "*" }, { "Sid": "GlueSourcesConsoleDisplay", "Effect": "Allow", "Action": [ "glue:GetSchema", "glue:SearchTables", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions" ], "Resource": "*" }, { "Sid": "S3BucketsConsoleDisplay", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "S3SourcesConsoleDisplay", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketVersions", "s3:GetBucketVersioning" ], "Resource": "*" }, { "Sid": "TaggingConsoleDisplay", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Sid": "KMSConsoleDisplay", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "ListRolesToPickRoleForPassing", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "PassRoleToEntityResolutionService", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*entityresolution*", "Condition": { "StringEquals": { "iam:PassedToService": [ "entityresolution.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2023-08-17T17:54:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EntityResolutionAccess", "Effect": "Allow", "Action": [ "entityresolution:*" ], "Resource": "*" }, { "Sid": "GlueSourcesConsoleDisplay", "Effect": "Allow", "Action": [ "glue:GetSchema", "glue:SearchTables", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions" ], "Resource": "*" }, { "Sid": "S3BucketsConsoleDisplay", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "S3SourcesConsoleDisplay", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketVersions", "s3:GetBucketVersioning" ], "Resource": "*" }, { "Sid": "TaggingConsoleDisplay", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues" ], "Resource": "*" }, { "Sid": "KMSConsoleDisplay", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "ListRolesToPickRoleForPassing", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "PassRoleToEntityResolutionService", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*entityresolution*", "Condition": { "StringEquals": { "iam:PassedToService": [ "entityresolution.amazonaws.com" ] } } }, { "Sid": "ManageEventBridgeRules", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutTargets", "events:PutRule" ], "Resource": [ "arn:aws:events:*:*:rule/entity-resolution-automatic*" ] }, { "Sid": "ADXReadAccess", "Effect": "Allow", "Action": [ "dataexchange:GetDataSet" ], "Resource": "*" } ] } } }, "createdDate": "2023-08-17T17:54:14.000Z", "lastUpdatedDate": "2023-10-16T18:46:10.000Z" }, "AWSEntityResolutionConsoleReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSEntityResolutionConsoleReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-17T18:18:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EntityResolutionRead", "Effect": "Allow", "Action": [ "entityresolution:Get*", "entityresolution:List*" ], "Resource": "*" } ] } } }, "createdDate": "2023-08-17T18:18:36.000Z", "lastUpdatedDate": "2023-08-17T18:18:36.000Z" }, "AWSArtifactServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSArtifactServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-08-21T20:27:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2023-08-21T20:27:31.000Z", "lastUpdatedDate": "2023-08-21T20:27:31.000Z" }, "AWSApplicationMigrationServiceEc2InstancePolicy": { "arn": "arn:aws:iam::aws:policy/AWSApplicationMigrationServiceEc2InstancePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-08-22T13:19:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendClientLogsForMgn", "mgn:RegisterAgentForMgn", "mgn:GetAgentInstallationAssetsForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn" ], "Resource": "arn:aws:mgn:*:*:source-server/*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*", "Condition": { "StringEquals": { "mgn:CreateAction": "RegisterAgentForMgn" } } } ] } }, "v2": { "createdDate": "2023-08-22T13:19:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MgnAgentInstallation", "Effect": "Allow", "Action": [ "mgn:SendClientLogsForMgn", "mgn:RegisterAgentForMgn", "mgn:GetAgentInstallationAssetsForMgn" ], "Resource": "*" }, { "Sid": "MgnAgentReplication", "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn" ], "Resource": "arn:aws:mgn:*:*:source-server/*" }, { "Sid": "MgnSourceServerTagResource", "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*", "Condition": { "StringEquals": { "mgn:CreateAction": "RegisterAgentForMgn" } } } ] } } }, "createdDate": "2023-08-22T13:19:02.000Z", "lastUpdatedDate": "2024-01-03T14:19:47.000Z" }, "AmazonLaunchWizardFullAccessV2": { "arn": "arn:aws:iam::aws:policy/AmazonLaunchWizardFullAccessV2", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-09-01T17:14:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AppInsightsActions0", "Effect": "Allow", "Action": "applicationinsights:*", "Resource": "*" }, { "Sid": "ResourceGroupActions0", "Effect": "Allow", "Action": "resource-groups:List*", "Resource": "*" }, { "Sid": "Route53Actions0", "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:GetChange", "route53:ListResourceRecordSets", "route53:ListHostedZones", "route53:ListHostedZonesByName" ], "Resource": "*" }, { "Sid": "S3Actions0", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "*" }, { "Sid": "KmsActions0", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "CloudWatchActions0", "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*" ], "Resource": "*" }, { "Sid": "Ec2Actions0", "Effect": "Allow", "Action": [ "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreateVpc", "ec2:CreateKeyPair", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet" ], "Resource": "*" }, { "Sid": "Ec2Actions1", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AllocateHosts", "ec2:AssignPrivateIpAddresses", "ec2:AssociateAddress", "ec2:CreateDhcpOptions", "ec2:CreateEgressOnlyInternetGateway", "ec2:CreateNetworkInterface", "ec2:CreateVolume", "ec2:CreateVpcEndpoint", "ec2:CreateTags", "ec2:DeleteTags", "ec2:RunInstances", "ec2:StartInstances", "ec2:ModifyInstanceAttribute", "ec2:ModifySubnetAttribute", "ec2:ModifyVolumeAttribute", "ec2:ModifyVpcAttribute", "ec2:AssociateDhcpOptions", "ec2:AssociateSubnetCidrBlock", "ec2:AttachInternetGateway", "ec2:AttachNetworkInterface", "ec2:AttachVolume", "ec2:DeleteDhcpOptions", "ec2:DeleteInternetGateway", "ec2:DeleteKeyPair", "ec2:DeleteNatGateway", "ec2:DeleteSecurityGroup", "ec2:DeleteVolume", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DetachVolume", "ec2:DeleteSnapshot", "ec2:AssociateRouteTable", "ec2:AssociateVpcCidrBlock", "ec2:DeleteNetworkAcl", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DetachNetworkInterface", "ec2:DisassociateAddress", "ec2:DisassociateVpcCidrBlock", "ec2:GetLaunchTemplateData", "ec2:ModifyNetworkInterfaceAttribute", "ec2:ModifyVolume", "ec2:AuthorizeSecurityGroupEgress", "ec2:GetConsoleOutput", "ec2:GetPasswordData", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:ReplaceRouteTableAssociation", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DisassociateIamInstanceProfile", "ec2:DisassociateRouteTable", "ec2:DisassociateSubnetCidrBlock", "ec2:ModifyInstancePlacement", "ec2:DeletePlacementGroup", "ec2:CreatePlacementGroup", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "ds:AddIpRoutes", "ds:CreateComputer", "ds:CreateMicrosoftAD", "ds:DeleteDirectory", "servicecatalog:AssociateProductWithPortfolio", "cloudformation:GetTemplateSummary", "sts:GetCallerIdentity" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "CloudFormationActions0", "Effect": "Allow", "Action": [ "cloudformation:DescribeStack*", "cloudformation:Get*", "cloudformation:ListStacks", "cloudformation:SignalResource", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/LaunchWizard*/*", "arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*" ] }, { "Sid": "Ec2Actions2", "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Sid": "IamActions0", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Sid": "IamActions1", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard", "arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard", "arn:aws:iam::*:instance-profile/LaunchWizard*" ], "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "lambda.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } }, { "Sid": "AutoScalingActions0", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:UpdateAutoScalingGroup", "autoscaling:CreateOrUpdateTags", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "sns:ListSubscriptionsByTopic", "sns:Publish", "ssm:DeleteDocument", "ssm:DeleteParameter*", "ssm:DescribeDocument*", "ssm:GetDocument", "ssm:PutParameter" ], "Resource": [ "arn:aws:resource-groups:*:*:group/LaunchWizard*", "arn:aws:sns:*:*:*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*", "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Sid": "SsmActions0", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript" ] }, { "Sid": "SsmActions1", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" } } }, { "Sid": "SsmActions2", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:DescribeDocument", "ssm:GetDocument", "ssm:ListTagsForResource", "ssm:RemoveTagsFromResource" ], "Resource": [ "arn:aws:ssm:*:*:parameter/LaunchWizard*", "arn:aws:ssm:*:*:document/LaunchWizard*" ] }, { "Sid": "SsmActions3", "Effect": "Allow", "Action": [ "autoscaling:Describe*", "cloudformation:DescribeAccountLimits", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:List*", "cloudformation:ValidateTemplate", "ds:Describe*", "ds:ListAuthorizedApplications", "ec2:Describe*", "ec2:Get*", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:List*", "resource-groups:Get*", "resource-groups:List*", "servicequotas:GetServiceQuota", "servicequotas:ListServiceQuotas", "sns:ListSubscriptions", "sns:ListTopics", "ssm:CreateDocument", "ssm:DescribeAutomation*", "ssm:DescribeInstanceInformation", "ssm:DescribeParameters", "ssm:GetAutomationExecution", "ssm:GetCommandInvocation", "ssm:GetParameter*", "ssm:GetConnectionStatus", "ssm:ListCommand*", "ssm:ListDocument*", "ssm:ListInstanceAssociations", "ssm:SendAutomationSignal", "tag:Get*" ], "Resource": "*" }, { "Sid": "SsmActions4", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "CloudFormationActions1", "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/" }, { "Sid": "IamActions2", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "autoscaling.amazonaws.com", "application-insights.amazonaws.com", "events.amazonaws.com", "autoscaling.amazonaws.com.cn", "events.amazonaws.com.cn" ] } } }, { "Sid": "LaunchWizardActions0", "Effect": "Allow", "Action": "launchwizard:*", "Resource": "*" }, { "Sid": "SqsActions0", "Effect": "Allow", "Action": [ "sqs:TagQueue", "sqs:GetQueueUrl", "sqs:AddPermission", "sqs:ListQueues", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "sqs:CreateQueue", "sqs:SetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:LaunchWizard*" }, { "Sid": "CloudWatchActions1", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "iam:GetInstanceProfile", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:LaunchWizard*", "arn:aws:iam::*:instance-profile/LaunchWizard*" ] }, { "Sid": "EfsActions0", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "route53:ListHostedZones", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DescribeMountTargetSecurityGroups" ], "Resource": "*" }, { "Sid": "S3Actions1", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::launchwizard*", "arn:aws:s3:::launchwizard*/*", "arn:aws:s3:::aws-sap-data-provider/config.properties" ] }, { "Sid": "CloudFormationActions2", "Effect": "Allow", "Action": "cloudformation:TagResource", "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "LaunchWizard*" } } }, { "Sid": "LambdaActions0", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketVersioning", "s3:DeleteBucket", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:LaunchWizard*", "arn:aws:s3:::launchwizard*" ] }, { "Sid": "DynamodbActions0", "Effect": "Allow", "Action": [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable" ], "Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*" }, { "Sid": "SecretsManagerActions0", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*" }, { "Sid": "SecretsManagerActions1", "Effect": "Allow", "Action": [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "SsmActions5", "Effect": "Allow", "Action": [ "ssm:CreateOpsMetadata" ], "Resource": "*" }, { "Sid": "SsmActions6", "Effect": "Allow", "Action": "ssm:DeleteOpsMetadata", "Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*" }, { "Sid": "SnsActions0", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:DeleteTopic", "sns:Subscribe", "sns:Unsubscribe" ], "Resource": "arn:aws:sns:*:*:LaunchWizard*" }, { "Sid": "FsxActions0", "Effect": "Allow", "Action": [ "fsx:UntagResource", "fsx:TagResource", "fsx:DeleteFileSystem", "fsx:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "LaunchWizard*" } } }, { "Sid": "FsxActions1", "Effect": "Allow", "Action": [ "fsx:CreateFileSystem" ], "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/Name": [ "LaunchWizard*" ] } } }, { "Sid": "FsxActions2", "Effect": "Allow", "Action": [ "fsx:DescribeFileSystems" ], "Resource": "*" }, { "Sid": "ServiceCatalogActions0", "Effect": "Allow", "Action": [ "servicecatalog:CreatePortfolio", "servicecatalog:DescribePortfolio", "servicecatalog:CreateConstraint", "servicecatalog:CreateProduct", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:TagResource", "servicecatalog:UntagResource" ], "Resource": [ "arn:aws:servicecatalog:*:*:*/*", "arn:aws:catalog:*:*:*/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "SsmActions7", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:DeleteAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:association/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "EfsActions1", "Effect": "Allow", "Action": [ "elasticfilesystem:UntagResource", "elasticfilesystem:TagResource" ], "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "LogsActions0", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DescribeLogStreams", "logs:UntagResource", "logs:TagResource", "logs:CreateLogGroup", "logs:DeleteLogStream", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogDelivery", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:ListLogDeliveries" ], "Resource": [ "arn:aws:logs:*:*:log-group:LaunchWizard*", "arn:aws:logs:*:*:log-group:LaunchWizard*:log-stream:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "LogsActions1", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "launchwizard.amazonaws.com" } } }, { "Sid": "FsxActions3", "Effect": "Allow", "Action": [ "fsx:CreateStorageVirtualMachine", "fsx:CreateVolume" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "launchwizard.amazonaws.com" ] } } }, { "Sid": "FsxActions4", "Effect": "Allow", "Action": [ "fsx:DescribeStorageVirtualMachines", "fsx:DescribeVolumes" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "launchwizard.amazonaws.com" ] } } }, { "Sid": "FsxActions5", "Effect": "Allow", "Action": [ "fsx:DeleteStorageVirtualMachine", "fsx:DeleteVolume" ], "Resource": [ "arn:aws:fsx:*:*:storage-virtual-machine/*/*", "arn:aws:fsx:*:*:backup/*", "arn:aws:fsx:*:*:volume/*/*" ], "Condition": { "StringLike": { "aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "launchwizard.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-09-01T17:14:56.000Z", "lastUpdatedDate": "2023-09-01T17:14:56.000Z" }, "AWSServiceRoleForCloudWatchMetrics_DbPerfInsightsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForCloudWatchMetrics_DbPerfInsightsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-09-07T09:32:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "pi:GetResourceMetrics" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-09-07T09:32:32.000Z", "lastUpdatedDate": "2023-09-07T09:32:32.000Z" }, "AmazonDataZoneEnvironmentRolePermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-09-11T23:38:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } } }, { "Effect": "Allow", "Action": [ "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:Verify", "kms:Sign" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Effect": "Allow", "Action": [ "datazone:*", "sqlworkbench:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:Describe*", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:SearchTables", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "iam:GetRole", "iam:GetRolePolicy", "iam:ListGroups", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUsers", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeMetricFilters", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "*", "aws:ResourceTag/AmazonDataZoneProject": "*" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/datazone/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "s3:prefix": "datazone/" } } }, { "Effect": "Deny", "NotAction": [ "datazone:*", "sqlworkbench:*", "athena:BatchGetQueryExecution", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteTags", "ec2:Describe*", "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "iam:GetRole", "iam:GetRolePolicy", "iam:List*", "iam:PassRole", "kms:DescribeKey", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ListKeys", "kms:Verify", "kms:Sign", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2023-09-11T23:38:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } } }, { "Effect": "Allow", "Action": [ "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:Verify", "kms:Sign" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Effect": "Allow", "Action": [ "datazone:*", "sqlworkbench:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "athena:BatchGetQueryExecution", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:Describe*", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:SearchTables", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "iam:GetRole", "iam:GetRolePolicy", "iam:ListGroups", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUsers", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeMetricFilters", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "secretsmanager:ListSecrets", "tag:GetResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "*", "aws:ResourceTag/AmazonDataZoneProject": "*" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/datazone/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "*" ], "Condition": { "StringLike": { "s3:prefix": [ "*/datazone/*", "datazone/*" ] } } }, { "Effect": "Deny", "NotAction": [ "datazone:*", "sqlworkbench:*", "athena:BatchGetQueryExecution", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteTags", "ec2:Describe*", "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "iam:GetRole", "iam:GetRolePolicy", "iam:List*", "iam:PassRole", "kms:DescribeKey", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ListKeys", "kms:Verify", "kms:Sign", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource", "tag:GetResources" ], "Resource": [ "*" ] } ] } }, "v3": { "createdDate": "2023-09-11T23:38:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateGlueConnection", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } } }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" } } }, { "Sid": "SameAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:Verify", "kms:Sign" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AnalyticsOperations", "Effect": "Allow", "Action": [ "datazone:*", "sqlworkbench:*" ], "Resource": "*" }, { "Sid": "QueryOperations", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:Describe*", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:SearchTables", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "iam:GetRole", "iam:GetRolePolicy", "iam:ListGroups", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUsers", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeMetricFilters", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "secretsmanager:ListSecrets", "tag:GetResources" ], "Resource": "*" }, { "Sid": "SecretsManagerOperationsWithTagKeys", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "*", "aws:ResourceTag/AmazonDataZoneProject": "*" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "DataZoneS3Buckets", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject" ], "Resource": [ "arn:aws:s3:::*/datazone/*" ] }, { "Sid": "DataZoneS3BucketLocation", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*" }, { "Sid": "ListDataZoneS3Bucket", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "*" ], "Condition": { "StringLike": { "s3:prefix": [ "*/datazone/*", "datazone/*" ] } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "datazone:*", "sqlworkbench:*", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteTags", "ec2:Describe*", "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "iam:GetRole", "iam:GetRolePolicy", "iam:List*", "iam:PassRole", "kms:DescribeKey", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ListKeys", "kms:Verify", "kms:Sign", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource", "tag:GetResources" ], "Resource": [ "*" ] } ] } }, "v4": { "createdDate": "2023-09-11T23:38:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateGlueConnection", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "aws-glue-service-resource" ] } } }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": "glue.amazonaws.com" } } }, { "Sid": "SameAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:Verify", "kms:Sign" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AnalyticsOperations", "Effect": "Allow", "Action": [ "datazone:*", "sqlworkbench:*" ], "Resource": "*" }, { "Sid": "QueryOperations", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:Describe*", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:SearchTables", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDatabase", "glue:UpdatePartition", "glue:UpdateTable", "iam:GetRole", "iam:GetRolePolicy", "iam:ListGroups", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUsers", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeMetricFilters", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "secretsmanager:ListSecrets", "tag:GetResources" ], "Resource": "*" }, { "Sid": "QueryOperationsWithResourceTag", "Effect": "Allow", "Action": [ "athena:GetQueryResultsStream" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "SecretsManagerOperationsWithTagKeys", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "*", "aws:ResourceTag/AmazonDataZoneProject": "*" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "DataZoneS3Buckets", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject" ], "Resource": [ "arn:aws:s3:::*/datazone/*" ] }, { "Sid": "DataZoneS3BucketLocation", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*" }, { "Sid": "ListDataZoneS3Bucket", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "*" ], "Condition": { "StringLike": { "s3:prefix": [ "*/datazone/*", "datazone/*" ] } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "datazone:*", "sqlworkbench:*", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteTags", "ec2:Describe*", "glue:*DataQuality*", "glue:BatchCreatePartition", "glue:BatchDeleteConnection", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetJobs", "glue:BatchGetPartition", "glue:BatchGetWorkflows", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CreateBlueprint", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDatabase", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteConnection", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:ListSchemas", "glue:ListJobs", "glue:NotifyEvent", "glue:PutWorkflowRunProperties", "glue:ResetJobBookmark", "glue:ResumeWorkflowRun", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCrawler", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopCrawler", "glue:StopCrawlerSchedule", "glue:StopWorkflowRun", "glue:UpdateBlueprint", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateConnection", "glue:UpdateCrawler", "glue:UpdateCrawlerSchedule", "glue:UpdateDatabase", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "iam:GetRole", "iam:GetRolePolicy", "iam:List*", "iam:PassRole", "kms:DescribeKey", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ListKeys", "kms:Verify", "kms:Sign", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:StartQuery", "logs:StopQuery", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:GetLogRecord", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "redshift-data:ListTables", "redshift-data:DescribeTable", "redshift-data:ListSchemas", "redshift-data:ListDatabases", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:DescribeStatement", "redshift:CreateClusterUser", "redshift:DescribeClusters", "redshift:DescribeDataShares", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:JoinGroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:CreateSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource", "tag:GetResources" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2023-09-11T23:38:22.000Z", "lastUpdatedDate": "2023-11-17T23:29:08.000Z" }, "AmazonKeyspacesReadOnlyAccess_v2": { "arn": "arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-09-12T17:01:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "kms:DescribeKey", "kms:ListAliases" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcEndpoints" ], "Resource": "*" } ] } } }, "createdDate": "2023-09-12T17:01:45.000Z", "lastUpdatedDate": "2023-09-12T17:01:45.000Z" }, "AWSElasticDisasterRecoveryLaunchActionsPolicy": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryLaunchActionsPolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-09-13T07:38:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:document/*", "arn:aws:ssm:*:*:automation-definition/*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*::document/AWS-*", "arn:aws:ssm:*::document/AWSCodeDeployAgent-*", "arn:aws:ssm:*::document/AWSConfigRemediation-*", "arn:aws:ssm:*::document/AWSConformancePacks-*", "arn:aws:ssm:*::document/AWSDisasterRecovery-*", "arn:aws:ssm:*::document/AWSDistroOTel-*", "arn:aws:ssm:*::document/AWSDocs-*", "arn:aws:ssm:*::document/AWSEC2-*", "arn:aws:ssm:*::document/AWSEC2Launch-*", "arn:aws:ssm:*::document/AWSFIS-*", "arn:aws:ssm:*::document/AWSFleetManager-*", "arn:aws:ssm:*::document/AWSIncidents-*", "arn:aws:ssm:*::document/AWSKinesisTap-*", "arn:aws:ssm:*::document/AWSMigration-*", "arn:aws:ssm:*::document/AWSNVMe-*", "arn:aws:ssm:*::document/AWSNitroEnclavesWindows-*", "arn:aws:ssm:*::document/AWSObservabilityExporter-*", "arn:aws:ssm:*::document/AWSPVDriver-*", "arn:aws:ssm:*::document/AWSQuickSetupType-*", "arn:aws:ssm:*::document/AWSQuickStarts-*", "arn:aws:ssm:*::document/AWSRefactorSpaces-*", "arn:aws:ssm:*::document/AWSResilienceHub-*", "arn:aws:ssm:*::document/AWSSAP-*", "arn:aws:ssm:*::document/AWSSAPTools-*", "arn:aws:ssm:*::document/AWSSQLServer-*", "arn:aws:ssm:*::document/AWSSSO-*", "arn:aws:ssm:*::document/AWSSupport-*", "arn:aws:ssm:*::document/AWSSystemsManagerSAP-*", "arn:aws:ssm:*::document/AmazonCloudWatch-*", "arn:aws:ssm:*::document/AmazonCloudWatchAgent-*", "arn:aws:ssm:*::document/AmazonECS-*", "arn:aws:ssm:*::document/AmazonEFSUtils-*", "arn:aws:ssm:*::document/AmazonEKS-*", "arn:aws:ssm:*::document/AmazonInspector-*", "arn:aws:ssm:*::document/AmazonInspector2-*", "arn:aws:ssm:*::document/AmazonInternal-*", "arn:aws:ssm:*::document/AwsEnaNetworkDriver-*", "arn:aws:ssm:*::document/AwsVssComponents-*", "arn:aws:ssm:*::automation-definition/AWS-*:*", "arn:aws:ssm:*::automation-definition/AWSCodeDeployAgent-*:*", "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-*:*", "arn:aws:ssm:*::automation-definition/AWSConformancePacks-*:*", "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", "arn:aws:ssm:*::automation-definition/AWSFleetManager-*:*", "arn:aws:ssm:*::automation-definition/AWSIncidents-*:*", "arn:aws:ssm:*::automation-definition/AWSKinesisTap-*:*", "arn:aws:ssm:*::automation-definition/AWSMigration-*:*", "arn:aws:ssm:*::automation-definition/AWSNVMe-*:*", "arn:aws:ssm:*::automation-definition/AWSNitroEnclavesWindows-*:*", "arn:aws:ssm:*::automation-definition/AWSObservabilityExporter-*:*", "arn:aws:ssm:*::automation-definition/AWSPVDriver-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickSetupType-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickStarts-*:*", "arn:aws:ssm:*::automation-definition/AWSRefactorSpaces-*:*", "arn:aws:ssm:*::automation-definition/AWSResilienceHub-*:*", "arn:aws:ssm:*::automation-definition/AWSSAP-*:*", "arn:aws:ssm:*::automation-definition/AWSSAPTools-*:*", "arn:aws:ssm:*::automation-definition/AWSSQLServer-*:*", "arn:aws:ssm:*::automation-definition/AWSSSO-*:*", "arn:aws:ssm:*::automation-definition/AWSSupport-*:*", "arn:aws:ssm:*::automation-definition/AWSSystemsManagerSAP-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatch-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatchAgent-*:*", "arn:aws:ssm:*::automation-definition/AmazonECS-*:*", "arn:aws:ssm:*::automation-definition/AmazonEFSUtils-*:*", "arn:aws:ssm:*::automation-definition/AmazonEKS-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector2-*:*", "arn:aws:ssm:*::automation-definition/AmazonInternal-*:*", "arn:aws:ssm:*::automation-definition/AwsEnaNetworkDriver-*:*", "arn:aws:ssm:*::automation-definition/AwsVssComponents-*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ListDocumentVersions", "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "drs.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-09-13T07:38:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LaunchActionsPolicy1", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy2", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:document/*", "arn:aws:ssm:*:*:automation-definition/*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy3", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*::document/AWS-*", "arn:aws:ssm:*::document/AWSCodeDeployAgent-*", "arn:aws:ssm:*::document/AWSConfigRemediation-*", "arn:aws:ssm:*::document/AWSConformancePacks-*", "arn:aws:ssm:*::document/AWSDisasterRecovery-*", "arn:aws:ssm:*::document/AWSDistroOTel-*", "arn:aws:ssm:*::document/AWSDocs-*", "arn:aws:ssm:*::document/AWSEC2-*", "arn:aws:ssm:*::document/AWSEC2Launch-*", "arn:aws:ssm:*::document/AWSFIS-*", "arn:aws:ssm:*::document/AWSFleetManager-*", "arn:aws:ssm:*::document/AWSIncidents-*", "arn:aws:ssm:*::document/AWSKinesisTap-*", "arn:aws:ssm:*::document/AWSMigration-*", "arn:aws:ssm:*::document/AWSNVMe-*", "arn:aws:ssm:*::document/AWSNitroEnclavesWindows-*", "arn:aws:ssm:*::document/AWSObservabilityExporter-*", "arn:aws:ssm:*::document/AWSPVDriver-*", "arn:aws:ssm:*::document/AWSQuickSetupType-*", "arn:aws:ssm:*::document/AWSQuickStarts-*", "arn:aws:ssm:*::document/AWSRefactorSpaces-*", "arn:aws:ssm:*::document/AWSResilienceHub-*", "arn:aws:ssm:*::document/AWSSAP-*", "arn:aws:ssm:*::document/AWSSAPTools-*", "arn:aws:ssm:*::document/AWSSQLServer-*", "arn:aws:ssm:*::document/AWSSSO-*", "arn:aws:ssm:*::document/AWSSupport-*", "arn:aws:ssm:*::document/AWSSystemsManagerSAP-*", "arn:aws:ssm:*::document/AmazonCloudWatch-*", "arn:aws:ssm:*::document/AmazonCloudWatchAgent-*", "arn:aws:ssm:*::document/AmazonECS-*", "arn:aws:ssm:*::document/AmazonEFSUtils-*", "arn:aws:ssm:*::document/AmazonEKS-*", "arn:aws:ssm:*::document/AmazonInspector-*", "arn:aws:ssm:*::document/AmazonInspector2-*", "arn:aws:ssm:*::document/AmazonInternal-*", "arn:aws:ssm:*::document/AwsEnaNetworkDriver-*", "arn:aws:ssm:*::document/AwsVssComponents-*", "arn:aws:ssm:*::automation-definition/AWS-*:*", "arn:aws:ssm:*::automation-definition/AWSCodeDeployAgent-*:*", "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-*:*", "arn:aws:ssm:*::automation-definition/AWSConformancePacks-*:*", "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", "arn:aws:ssm:*::automation-definition/AWSFleetManager-*:*", "arn:aws:ssm:*::automation-definition/AWSIncidents-*:*", "arn:aws:ssm:*::automation-definition/AWSKinesisTap-*:*", "arn:aws:ssm:*::automation-definition/AWSMigration-*:*", "arn:aws:ssm:*::automation-definition/AWSNVMe-*:*", "arn:aws:ssm:*::automation-definition/AWSNitroEnclavesWindows-*:*", "arn:aws:ssm:*::automation-definition/AWSObservabilityExporter-*:*", "arn:aws:ssm:*::automation-definition/AWSPVDriver-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickSetupType-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickStarts-*:*", "arn:aws:ssm:*::automation-definition/AWSRefactorSpaces-*:*", "arn:aws:ssm:*::automation-definition/AWSResilienceHub-*:*", "arn:aws:ssm:*::automation-definition/AWSSAP-*:*", "arn:aws:ssm:*::automation-definition/AWSSAPTools-*:*", "arn:aws:ssm:*::automation-definition/AWSSQLServer-*:*", "arn:aws:ssm:*::automation-definition/AWSSSO-*:*", "arn:aws:ssm:*::automation-definition/AWSSupport-*:*", "arn:aws:ssm:*::automation-definition/AWSSystemsManagerSAP-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatch-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatchAgent-*:*", "arn:aws:ssm:*::automation-definition/AmazonECS-*:*", "arn:aws:ssm:*::automation-definition/AmazonEFSUtils-*:*", "arn:aws:ssm:*::automation-definition/AmazonEKS-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector2-*:*", "arn:aws:ssm:*::automation-definition/AmazonInternal-*:*", "arn:aws:ssm:*::automation-definition/AwsEnaNetworkDriver-*:*", "arn:aws:ssm:*::automation-definition/AwsVssComponents-*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy4", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy5", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy6", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "LaunchActionsPolicy7", "Effect": "Allow", "Action": [ "ssm:ListDocumentVersions", "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "LaunchActionsPolicy8", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy9", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "LaunchActionsPolicy10", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy11", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "drs.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2023-09-13T07:38:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "LaunchActionsPolicy1", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:DescribeParameters" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy2", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:document/*", "arn:aws:ssm:*:*:automation-definition/*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy3", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*::document/AWS-*", "arn:aws:ssm:*::document/AWSCodeDeployAgent-*", "arn:aws:ssm:*::document/AWSConfigRemediation-*", "arn:aws:ssm:*::document/AWSConformancePacks-*", "arn:aws:ssm:*::document/AWSDisasterRecovery-*", "arn:aws:ssm:*::document/AWSDistroOTel-*", "arn:aws:ssm:*::document/AWSDocs-*", "arn:aws:ssm:*::document/AWSEC2-*", "arn:aws:ssm:*::document/AWSEC2Launch-*", "arn:aws:ssm:*::document/AWSFIS-*", "arn:aws:ssm:*::document/AWSFleetManager-*", "arn:aws:ssm:*::document/AWSIncidents-*", "arn:aws:ssm:*::document/AWSKinesisTap-*", "arn:aws:ssm:*::document/AWSMigration-*", "arn:aws:ssm:*::document/AWSNVMe-*", "arn:aws:ssm:*::document/AWSNitroEnclavesWindows-*", "arn:aws:ssm:*::document/AWSObservabilityExporter-*", "arn:aws:ssm:*::document/AWSPVDriver-*", "arn:aws:ssm:*::document/AWSQuickSetupType-*", "arn:aws:ssm:*::document/AWSQuickStarts-*", "arn:aws:ssm:*::document/AWSRefactorSpaces-*", "arn:aws:ssm:*::document/AWSResilienceHub-*", "arn:aws:ssm:*::document/AWSSAP-*", "arn:aws:ssm:*::document/AWSSAPTools-*", "arn:aws:ssm:*::document/AWSSQLServer-*", "arn:aws:ssm:*::document/AWSSSO-*", "arn:aws:ssm:*::document/AWSSupport-*", "arn:aws:ssm:*::document/AWSSystemsManagerSAP-*", "arn:aws:ssm:*::document/AmazonCloudWatch-*", "arn:aws:ssm:*::document/AmazonCloudWatchAgent-*", "arn:aws:ssm:*::document/AmazonECS-*", "arn:aws:ssm:*::document/AmazonEFSUtils-*", "arn:aws:ssm:*::document/AmazonEKS-*", "arn:aws:ssm:*::document/AmazonInspector-*", "arn:aws:ssm:*::document/AmazonInspector2-*", "arn:aws:ssm:*::document/AmazonInternal-*", "arn:aws:ssm:*::document/AwsEnaNetworkDriver-*", "arn:aws:ssm:*::document/AwsVssComponents-*", "arn:aws:ssm:*::automation-definition/AWS-*:*", "arn:aws:ssm:*::automation-definition/AWSCodeDeployAgent-*:*", "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-*:*", "arn:aws:ssm:*::automation-definition/AWSConformancePacks-*:*", "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", "arn:aws:ssm:*::automation-definition/AWSFleetManager-*:*", "arn:aws:ssm:*::automation-definition/AWSIncidents-*:*", "arn:aws:ssm:*::automation-definition/AWSKinesisTap-*:*", "arn:aws:ssm:*::automation-definition/AWSMigration-*:*", "arn:aws:ssm:*::automation-definition/AWSNVMe-*:*", "arn:aws:ssm:*::automation-definition/AWSNitroEnclavesWindows-*:*", "arn:aws:ssm:*::automation-definition/AWSObservabilityExporter-*:*", "arn:aws:ssm:*::automation-definition/AWSPVDriver-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickSetupType-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickStarts-*:*", "arn:aws:ssm:*::automation-definition/AWSRefactorSpaces-*:*", "arn:aws:ssm:*::automation-definition/AWSResilienceHub-*:*", "arn:aws:ssm:*::automation-definition/AWSSAP-*:*", "arn:aws:ssm:*::automation-definition/AWSSAPTools-*:*", "arn:aws:ssm:*::automation-definition/AWSSQLServer-*:*", "arn:aws:ssm:*::automation-definition/AWSSSO-*:*", "arn:aws:ssm:*::automation-definition/AWSSupport-*:*", "arn:aws:ssm:*::automation-definition/AWSSystemsManagerSAP-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatch-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatchAgent-*:*", "arn:aws:ssm:*::automation-definition/AmazonECS-*:*", "arn:aws:ssm:*::automation-definition/AmazonEFSUtils-*:*", "arn:aws:ssm:*::automation-definition/AmazonEKS-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector2-*:*", "arn:aws:ssm:*::automation-definition/AmazonInternal-*:*", "arn:aws:ssm:*::automation-definition/AwsEnaNetworkDriver-*:*", "arn:aws:ssm:*::automation-definition/AwsVssComponents-*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy4", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy5", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy6", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "LaunchActionsPolicy7", "Effect": "Allow", "Action": [ "ssm:ListDocumentVersions", "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "LaunchActionsPolicy8", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy9", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "LaunchActionsPolicy10", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy11", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "drs.amazonaws.com" } } } ] } } }, "createdDate": "2023-09-13T07:38:26.000Z", "lastUpdatedDate": "2024-05-19T07:29:42.000Z" }, "AmazonDataZoneFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2023-09-22T20:06:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "arn:aws:s3:::amazon-datazone*" }, { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2023-09-22T20:06:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "arn:aws:s3:::amazon-datazone*" }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } } ] } }, "v3": { "createdDate": "2023-09-22T20:06:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "arn:aws:s3:::amazon-datazone*" }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "IAMGetPolicyStatement", "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } } ] } }, "v4": { "createdDate": "2023-09-22T20:06:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "arn:aws:s3:::amazon-datazone*" }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "IAMGetPolicyStatement", "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid": "DataZoneTagOnCreateDomainProjectTags", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } } ] } }, "v5": { "createdDate": "2023-09-22T20:06:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets", "iam:ListUsers", "glue:GetDatabases", "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codewhisperer:ListProfiles", "bedrock:ListInferenceProfiles", "bedrock:ListFoundationModels", "bedrock:ListTagsForResource", "aoss:ListSecurityPolicies" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid": "ConfigureBucketStatement", "Effect": "Allow", "Action": [ "s3:PutBucketCORS", "s3:PutBucketPolicy", "s3:PutBucketVersioning" ], "Resource": [ "arn:aws:s3:::amazon-sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonSageMaker*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "IAMGetPolicyStatement", "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid": "DataZoneTagOnCreateDomainProjectTags", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "ConnectionStatement", "Effect": "Allow", "Action": [ "codeconnections:GetConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "TagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:TagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "for-use-with-all-datazone-projects" ] }, "StringEquals": { "aws:RequestTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "UntagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UntagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "for-use-with-all-datazone-projects" } } }, { "Sid": "SSMParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*", "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" ] }, { "Sid": "UseKMSKeyPermissionsStatement", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "true" }, "Null": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "false" }, "StringLike": { "kms:ViaService": "ssm.*.amazonaws.com" } } }, { "Sid": "SecurityPolicyStatement", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aoss:collection": "genai-studio-*" } } }, { "Sid": "GetFoundationModelStatement", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid": "GetInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Sid": "ApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:RequestTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "TagApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:TagResource" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "DeleteApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:DeleteInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false" } } } ] } } }, "createdDate": "2023-09-22T20:06:52.000Z", "lastUpdatedDate": "2024-11-21T20:36:06.000Z" }, "AmazonDataZoneRedshiftManageAccessRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDataZoneRedshiftManageAccessRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-09-22T20:15:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:ListTables", "redshift-data:ListSchemas", "redshift-data:ListDatabases" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Effect": "Allow", "Action": "redshift-serverless:GetWorkgroup", "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "redshift-serverless:GetNamespace", "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift:DescribeClusters" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare", "redshift:DescribeDataShares" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "redshift:AssociateDataShareConsumer", "Resource": "arn:aws:redshift:*:*:datashare:*/datazone*", "Condition": { "StringEquals": { "aws:ResourceOrgID": "${aws:PrincipalOrgID}" } } } ] } }, "v2": { "createdDate": "2023-09-22T20:15:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "redshiftDataScopeDownPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:ListTables", "redshift-data:ListSchemas", "redshift-data:ListDatabases" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "listSecretsPermission", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "getWorkgroupPermission", "Effect": "Allow", "Action": "redshift-serverless:GetWorkgroup", "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "getNamespacePermission", "Effect": "Allow", "Action": "redshift-serverless:GetNamespace", "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "redshiftDataPermissions", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "dataSharesPermissions", "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare", "redshift:DescribeDataShares" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "associateDataShareConsumerPermission", "Effect": "Allow", "Action": "redshift:AssociateDataShareConsumer", "Resource": "arn:aws:redshift:*:*:datashare:*/datazone*" } ] } }, "v3": { "createdDate": "2023-09-22T20:15:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "redshiftDataScopeDownPermissions", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:ListTables", "redshift-data:ListSchemas", "redshift-data:ListDatabases" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "listSecretsPermission", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "getWorkgroupPermission", "Effect": "Allow", "Action": "redshift-serverless:GetWorkgroup", "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "createAndDeleteWorkgroupPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "getNamespacePermission", "Effect": "Allow", "Action": "redshift-serverless:GetNamespace", "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "createAndDeleteNamespacePermissions", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:DeleteNamespace" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "redshiftDataPermissions", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "dataSharesPermissions", "Effect": "Allow", "Action": [ "redshift:AuthorizeDataShare", "redshift:DescribeDataShares" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "associateDataShareConsumerPermission", "Effect": "Allow", "Action": "redshift:AssociateDataShareConsumer", "Resource": "arn:aws:redshift:*:*:datashare:*/datazone*" } ] } } }, "createdDate": "2023-09-22T20:15:14.000Z", "lastUpdatedDate": "2025-03-07T00:07:06.000Z" }, "AmazonDataZoneRedshiftGlueProvisioningPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneRedshiftGlueProvisioningPolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v2": { "createdDate": "2023-09-22T20:19:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ], "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToManageCreatedEnvironmentRole", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneCFStackCreationForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneCFStackManagementForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Sid": "AmazonDataZoneEnvironmentParameterValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:GetDatabase", "athena:GetWorkGroup", "logs:DescribeLogGroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift:DescribeClusters", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "AmazonDataZoneEnvironmentLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentGlueDeletePermissions", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaDeletePermissions", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaResourceCreation", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:TagLogGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupManagement", "Action": [ "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Effect": "Allow", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentIAMPolicyManagement", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:GetPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentS3ValidationPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "AmazonDataZoneEnvironmentKMSDecryptPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToTagAmazonDataZoneEnvironmentGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:RequestTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } } ] } }, "v3": { "createdDate": "2023-09-22T20:19:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ], "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToManageCreatedEnvironmentRole", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneCFStackCreationForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneCFStackManagementForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Sid": "AmazonDataZoneEnvironmentParameterValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:GetDatabase", "athena:GetWorkGroup", "logs:DescribeLogGroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift:DescribeClusters", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "AmazonDataZoneEnvironmentLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentGlueDeletePermissions", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaDeletePermissions", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaResourceCreation", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:TagLogGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupManagement", "Action": [ "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Effect": "Allow", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentIAMPolicyManagement", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:GetPolicy", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:iam::*:policy/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentS3ValidationPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "AmazonDataZoneEnvironmentKMSDecryptPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToTagAmazonDataZoneEnvironmentGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:RequestTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "RedshiftDataPermissions", "Effect": "Allow", "Action": [ "redshift-data:ListSchemas", "redshift-data:ExecuteStatement" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "DescribeStatementPermissions", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement" ], "Resource": "*" }, { "Sid": "GetSecretValuePermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/AmazonDataZoneDomain": "dzd*" } } } ] } }, "v4": { "createdDate": "2023-09-22T20:19:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ], "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToManageCreatedEnvironmentRole", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneCFStackCreationForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneCFStackManagementForEnvironments", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Sid": "AmazonDataZoneEnvironmentParameterValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:GetDatabase", "athena:GetWorkGroup", "logs:DescribeLogGroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift:DescribeClusters", "secretsmanager:ListSecrets" ], "Resource": "*" }, { "Sid": "AmazonDataZoneEnvironmentLakeFormationPermissions", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentGlueDeletePermissions", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaDeletePermissions", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentAthenaResourceCreation", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:TagLogGroup" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentLogGroupManagement", "Action": [ "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:datazone-*", "Effect": "Allow", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentIAMPolicyManagement", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:GetPolicy", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentS3ValidationPermissions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "AmazonDataZoneEnvironmentKMSDecryptPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToTagAmazonDataZoneEnvironmentGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": "AmazonDataZoneEnvironment" }, "Null": { "aws:RequestTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "RedshiftDataPermissions", "Effect": "Allow", "Action": [ "redshift-data:ListSchemas", "redshift-data:ExecuteStatement" ], "Resource": [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid": "DescribeStatementPermissions", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement" ], "Resource": "*" }, { "Sid": "GetSecretValuePermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/AmazonDataZoneDomain": "dzd*" } } } ] } } }, "createdDate": "2023-09-22T20:19:54.000Z", "lastUpdatedDate": "2024-10-23T18:29:09.000Z" }, "AmazonDataZoneGlueManageAccessRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:GrantPermissions", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "lakeformation:GetResourceLFTags", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": "arn:aws:glue:*:*:catalog", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } } ] } }, "v2": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:GrantPermissions", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "lakeformation:GetResourceLFTags", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } } ] } }, "v3": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RevokePermissions", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } } ] } }, "v4": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueDataQualityPermissions", "Effect": "Allow", "Action": [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } }, { "Sid": "GetRoleForDataZone", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ] }, { "Sid": "PassRoleForDataLocationRegistration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lakeformation.amazonaws.com" ] } } } ] } }, "v5": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTagDatabasePermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists": { "aws:TagKeys": "DataZoneDiscoverable_*" } } }, { "Sid": "GlueDataQualityPermissions", "Effect": "Allow", "Action": [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } }, { "Sid": "GetRoleForDataZone", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ] }, { "Sid": "PassRoleForDataLocationRegistration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lakeformation.amazonaws.com" ] } } } ] } }, "v6": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTagDatabasePermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists": { "aws:TagKeys": "DataZoneDiscoverable_*" } } }, { "Sid": "GlueDataQualityPermissions", "Effect": "Allow", "Action": [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "StringLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } }, { "Sid": "GetRoleForDataZone", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ] }, { "Sid": "PassRoleForDataLocationRegistration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lakeformation.amazonaws.com" ] } } } ] } }, "v7": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTagDatabasePermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists": { "aws:TagKeys": "DataZoneDiscoverable_*" } } }, { "Sid": "GlueDataQualityPermissions", "Effect": "Allow", "Action": [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueTableDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables", "glue:SearchTables" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetTagsPermissions", "Effect": "Allow", "Action": [ "glue:GetTags", "glue:GetCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "LakeformationResourceFederatedSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*", "Condition": { "Null": { "lakeformation:GlueARN": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:GetResourceShares", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "ArnLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecryptPermission", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } }, { "Sid": "GetRoleForDataZone", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ] }, { "Sid": "PassRoleForDataLocationRegistration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lakeformation.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2023-09-22T20:21:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueTagDatabase", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists": { "aws:TagKeys": "DataZoneDiscoverable_*" } } }, { "Sid": "GlueDataQuality", "Effect": "Allow", "Action": [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueCrawler", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueTableDatabaseCatalog", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables", "glue:SearchTables", "glue:CreateCatalog", "glue:CreateDatabase", "glue:DeleteCatalog", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetTags", "Effect": "Allow", "Action": [ "glue:GetTags", "glue:GetCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeformationResourceSharing", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource": "*" }, { "Sid": "LakeformationResourceFederatedSharing", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*", "Condition": { "Null": { "lakeformation:GlueARN": "true" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharing", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountLakeFormationResourceSharing", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitation", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormation", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "GetResourceSharesViaLakeFormation", "Effect": "Allow", "Action": "ram:GetResourceShares", "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "ArnLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "KMSDecrypt", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/datazone:projectId": "proj-all" } } }, { "Sid": "GetRoleForDataZone", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*" ] }, { "Sid": "PassRoleForDataLocationRegistration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lakeformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid": "CreateCatalogEC2", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "CreateCatalogS3", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-09-22T20:21:53.000Z", "lastUpdatedDate": "2025-03-07T00:22:06.000Z" }, "AmazonDataZoneFullUserAccess": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneFullUserAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v2": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications" ], "Resource": "*" }, { "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:GetIamPortalLoginUrl", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v4": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:GetIamPortalLoginUrl", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:StopMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v5": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:GetIamPortalLoginUrl", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v6": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:PostTimeSeriesDataPoints", "datazone:ListTimeSeriesDataPoints", "datazone:GetTimeSeriesDataPoint", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:GetIamPortalLoginUrl", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v7": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:PostTimeSeriesDataPoints", "datazone:ListTimeSeriesDataPoints", "datazone:GetTimeSeriesDataPoint", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetDomain", "datazone:CreateFormType", "datazone:GetFormType", "datazone:GetIamPortalLoginUrl", "datazone:SearchUserProfiles", "datazone:SearchGroupProfiles", "datazone:GetUserProfile", "datazone:GetGroupProfile", "datazone:ListGroupsForUser", "datazone:DeleteFormType", "datazone:CreateAssetType", "datazone:GetAssetType", "datazone:DeleteAssetType", "datazone:CreateGlossary", "datazone:GetGlossary", "datazone:DeleteGlossary", "datazone:UpdateGlossary", "datazone:CreateGlossaryTerm", "datazone:GetGlossaryTerm", "datazone:DeleteGlossaryTerm", "datazone:UpdateGlossaryTerm", "datazone:CreateAsset", "datazone:GetAsset", "datazone:DeleteAsset", "datazone:CreateAssetRevision", "datazone:ListAssetRevisions", "datazone:AcceptPredictions", "datazone:RejectPredictions", "datazone:Search", "datazone:SearchTypes", "datazone:CreateListingChangeSet", "datazone:DeleteListing", "datazone:SearchListings", "datazone:GetListing", "datazone:CreateDataSource", "datazone:GetDataSource", "datazone:DeleteDataSource", "datazone:UpdateDataSource", "datazone:ListDataSources", "datazone:StartDataSourceRun", "datazone:GetDataSourceRun", "datazone:ListDataSourceRuns", "datazone:ListDataSourceRunActivities", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:CreateEnvironmentBlueprint", "datazone:GetEnvironmentBlueprint", "datazone:DeleteEnvironmentBlueprint", "datazone:UpdateEnvironmentBlueprint", "datazone:ListEnvironmentBlueprints", "datazone:CreateProject", "datazone:UpdateProject", "datazone:GetProject", "datazone:DeleteProject", "datazone:ListProjects", "datazone:CreateProjectMembership", "datazone:DeleteProjectMembership", "datazone:ListProjectMemberships", "datazone:CreateEnvironmentProfile", "datazone:GetEnvironmentProfile", "datazone:UpdateEnvironmentProfile", "datazone:DeleteEnvironmentProfile", "datazone:ListEnvironmentProfiles", "datazone:CreateEnvironment", "datazone:GetEnvironment", "datazone:DeleteEnvironment", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:ListEnvironments", "datazone:ListAccountEnvironments", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentCredentials", "datazone:GetSubscriptionTarget", "datazone:DeleteSubscriptionTarget", "datazone:ListSubscriptionTargets", "datazone:CreateSubscriptionRequest", "datazone:AcceptSubscriptionRequest", "datazone:UpdateSubscriptionRequest", "datazone:ListWarehouseMetadata", "datazone:RejectSubscriptionRequest", "datazone:GetSubscriptionRequestDetails", "datazone:ListSubscriptionRequests", "datazone:DeleteSubscriptionRequest", "datazone:GetSubscription", "datazone:CancelSubscription", "datazone:GetSubscriptionEligibility", "datazone:ListSubscriptions", "datazone:RevokeSubscription", "datazone:CreateSubscriptionGrant", "datazone:DeleteSubscriptionGrant", "datazone:GetSubscriptionGrant", "datazone:ListSubscriptionGrants", "datazone:UpdateSubscriptionGrantStatus", "datazone:ListNotifications", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns", "datazone:ListLineageNodeHistory", "datazone:GetLineageNode", "datazone:CreateAssetFilter", "datazone:DeleteAssetFilter", "datazone:GetAssetFilter", "datazone:ListAssetFilters", "datazone:UpdateAssetFilter" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v8": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetIamPortalLoginUrl", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:PostTimeSeriesDataPoints", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v9": { "createdDate": "2023-09-22T21:06:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneUserOperations", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateRule", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteRule", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetIamPortalLoginUrl", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetRule", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListRules", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:PostTimeSeriesDataPoints", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchRules", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateRule", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareOperations", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } } }, "createdDate": "2023-09-22T21:06:41.000Z", "lastUpdatedDate": "2024-11-19T21:38:59.000Z" }, "AmazonDataZoneDomainExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDataZoneDomainExecutionRolePolicy", "latestVersionId": "v10", "versionsCount": 10, "versions": { "v1": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v2": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:StopMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v3": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:StopMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v4": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v5": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:ListTimeSeriesDataPoints", "datazone:GetTimeSeriesDataPoint", "datazone:DeleteTimeSeriesDataPoints", "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v6": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:ListTimeSeriesDataPoints", "datazone:GetTimeSeriesDataPoint", "datazone:DeleteTimeSeriesDataPoints", "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns", "datazone:GetEnvironmentAction", "datazone:ListEnvironmentActions" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v7": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:ListTimeSeriesDataPoints", "datazone:GetTimeSeriesDataPoint", "datazone:DeleteTimeSeriesDataPoints", "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataSource", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetType", "datazone:DeleteDataSource", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:GetAsset", "datazone:GetAssetType", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetEnvironment", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetListing", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListNotifications", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:UpdateDataSource", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest", "datazone:StartMetadataGenerationRun", "datazone:GetMetadataGenerationRun", "datazone:CancelMetadataGenerationRun", "datazone:ListMetadataGenerationRuns", "datazone:GetEnvironmentAction", "datazone:ListEnvironmentActions", "datazone:ListLineageNodeHistory", "datazone:GetLineageNode", "datazone:CreateAssetFilter", "datazone:DeleteAssetFilter", "datazone:GetAssetFilter", "datazone:ListAssetFilters", "datazone:UpdateAssetFilter" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v8": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v9": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateRule", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteRule", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetRule", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListRules", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchRules", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateRule", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } }, "v10": { "createdDate": "2023-09-27T21:55:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DomainExecutionRoleStatement", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentBlueprint", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateRule", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentBlueprint", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteRule", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetRule", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListRules", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchRules", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentBlueprint", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateRule", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": "ram:GetResourceShareAssociations", "Resource": "*" } ] } } }, "createdDate": "2023-09-27T21:55:08.000Z", "lastUpdatedDate": "2024-12-03T14:06:07.000Z" }, "AWSS3OnOutpostsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSS3OnOutpostsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-10-03T20:32:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:DescribeAddresses", "ec2:DescribeLocalGatewayRouteTableVpcAssociations" ], "Resource": "*", "Sid": "DescribeVpcResources" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Sid": "CreateNetworkInterface" }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "S3 On Outposts" } }, "Sid": "CreateTagsForCreateNetworkInterface" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:ipv4pool-ec2/*" ], "Sid": "AllocateIpAddress" }, { "Effect": "Allow", "Action": [ "ec2:AllocateAddress" ], "Resource": [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "S3 On Outposts" } }, "Sid": "CreateTagsForAllocateIpAddress" }, { "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:AssociateAddress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "S3 On Outposts" } }, "Sid": "ReleaseVpcResources" }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateNetworkInterface", "AllocateAddress" ], "aws:RequestTag/CreatedBy": [ "S3 On Outposts" ] } }, "Sid": "CreateTags" } ] } } }, "createdDate": "2023-10-03T20:32:36.000Z", "lastUpdatedDate": "2023-10-03T20:32:36.000Z" }, "AmazonSageMakerCanvasDirectDeployAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerCanvasDirectDeployAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-10-06T18:11:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerEndpointPerms", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:InvokeEndpoint", "sagemaker:UpdateEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:Canvas*", "arn:aws:sagemaker:*:*:canvas*" ] }, { "Sid": "ReadCWInvocationMetrics", "Effect": "Allow", "Action": "cloudwatch:GetMetricData", "Resource": "*" } ] } } }, "createdDate": "2023-10-06T18:11:53.000Z", "lastUpdatedDate": "2023-10-06T18:11:53.000Z" }, "AmplifyBackendDeployFullAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AmplifyBackendDeployFullAccess", "latestVersionId": "v9", "versionsCount": 9, "versions": { "v1": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ] }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction" ], "Resource": [ "*" ] }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ] }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ] }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ] }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction" ], "Resource": [ "*" ] }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ] }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ] }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v3": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ] }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v4": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ] }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableSchemaResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v5": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableFunctionResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v6": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableFunctionResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyDiscoverRDSVpcConfig", "Effect": "Allow", "Action": [ "rds:DescribeDBProxies", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "ec2:DescribeSubnets", "rds:DescribeDBSubnetGroups" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:cluster:*", "arn:aws:rds:*:*:db-proxy:*", "arn:aws:rds:*:*:subgrp:*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v7": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableFunctionResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*", "arn:aws:ssm:*:*:parameter/cdk-bootstrap/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyDiscoverRDSVpcConfig", "Effect": "Allow", "Action": [ "rds:DescribeDBProxies", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "ec2:DescribeSubnets", "rds:DescribeDBSubnetGroups" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:cluster:*", "arn:aws:rds:*:*:db-proxy:*", "arn:aws:rds:*:*:subgrp:*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v8": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableFunctionResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySandboxLambdaLogsStreamingListTags", "Effect": "Allow", "Action": [ "lambda:ListTags" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ] }, { "Sid": "AmplifySandboxLambdaLogsStreamingFilterLogEvents", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/amplify-*:*" ] }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*", "arn:aws:ssm:*:*:parameter/cdk-bootstrap/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyDiscoverRDSVpcConfig", "Effect": "Allow", "Action": [ "rds:DescribeDBProxies", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "ec2:DescribeSubnets", "rds:DescribeDBSubnetGroups" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:cluster:*", "arn:aws:rds:*:*:db-proxy:*", "arn:aws:rds:*:*:subgrp:*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v9": { "createdDate": "2023-10-06T21:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CDKPreDeploy", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:GetTemplateSummary", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/amplify-*", "arn:aws:cloudformation:*:*:stack/CDKToolkit/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyMetadata", "Effect": "Allow", "Action": [ "amplify:ListApps", "cloudformation:ListStacks", "ssm:DescribeParameters", "appsync:GetIntrospectionSchema", "amplify:GetBackendEnvironment" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableResources", "Effect": "Allow", "Action": [ "appsync:GetSchemaCreationStatus", "appsync:StartSchemaCreation", "appsync:UpdateResolver", "appsync:ListFunctions", "appsync:UpdateFunction", "appsync:UpdateApiKey" ], "Resource": [ "*" ] }, { "Sid": "AmplifyHotSwappableFunctionResource", "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:UpdateFunctionCode", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySandboxLambdaLogsStreamingListTags", "Effect": "Allow", "Action": [ "lambda:ListTags" ], "Resource": [ "arn:aws:lambda:*:*:function:amplify-*" ] }, { "Sid": "AmplifySandboxLambdaLogsStreamingFilterLogEvents", "Effect": "Allow", "Action": [ "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/amplify-*:*", "arn:aws:logs:*:*:log-group:amplify-*:*" ] }, { "Sid": "AmplifySchema", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*amplify*", "arn:aws:s3:::cdk-*-assets-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CDKDeploy", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": [ "arn:aws:iam::*:role/cdk-*-deploy-role-*-*", "arn:aws:iam::*:role/cdk-*-file-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-image-publishing-role-*-*", "arn:aws:iam::*:role/cdk-*-lookup-role-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifySSM", "Effect": "Allow", "Action": [ "ssm:GetParametersByPath", "ssm:GetParameters", "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amplify/*", "arn:aws:ssm:*:*:parameter/cdk-bootstrap/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyModifySSMParam", "Effect": "Allow", "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/amplify/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmplifyDiscoverRDSVpcConfig", "Effect": "Allow", "Action": [ "rds:DescribeDBProxies", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "ec2:DescribeSubnets", "rds:DescribeDBSubnetGroups" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:cluster:*", "arn:aws:rds:*:*:db-proxy:*", "arn:aws:rds:*:*:subgrp:*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-10-06T21:32:59.000Z", "lastUpdatedDate": "2024-11-14T19:09:39.000Z" }, "AmazonConnectSynchronizationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonConnectSynchronizationServiceRolePolicy", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-10-27T22:38:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:CreateUser*", "connect:UpdateUser*", "connect:DeleteUser*", "connect:DescribeUser*", "connect:ListUser*", "connect:CreateRoutingProfile", "connect:UpdateRoutingProfile*", "connect:DeleteRoutingProfile", "connect:DescribeRoutingProfile", "connect:ListRoutingProfile*", "connect:CreateAgentStatus", "connect:UpdateAgentStatus", "connect:DescribeAgentStatus", "connect:ListAgentStatuses", "connect:CreateQuickConnect", "connect:UpdateQuickConnect*", "connect:DeleteQuickConnect", "connect:DescribeQuickConnect", "connect:ListQuickConnects", "connect:CreateHoursOfOperation", "connect:UpdateHoursOfOperation", "connect:DeleteHoursOfOperation", "connect:DescribeHoursOfOperation", "connect:ListHoursOfOperations", "connect:CreateQueue", "connect:UpdateQueue*", "connect:DeleteQueue", "connect:DescribeQueue", "connect:ListQueue*", "connect:CreatePrompt", "connect:UpdatePrompt", "connect:DeletePrompt", "connect:DescribePrompt", "connect:ListPrompts", "connect:GetPromptFile", "connect:CreateSecurityProfile", "connect:UpdateSecurityProfile", "connect:DeleteSecurityProfile", "connect:DescribeSecurityProfile", "connect:ListSecurityProfile*", "connect:CreateContactFlow*", "connect:UpdateContactFlow*", "connect:DeleteContactFlow*", "connect:DescribeContactFlow*", "connect:ListContactFlow*", "connect:BatchGetFlowAssociation", "connect:CreatePredefinedAttribute", "connect:UpdatePredefinedAttribute", "connect:DeletePredefinedAttribute", "connect:DescribePredefinedAttribute", "connect:ListPredefinedAttributes", "connect:ListTagsForResource", "connect:TagResource", "connect:UntagResource", "connect:ListTrafficDistributionGroups", "connect:ListPhoneNumbersV2", "connect:UpdatePhoneNumber", "connect:DescribePhoneNumber", "connect:Associate*", "connect:Disassociate*" ], "Resource": "*" }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v2": { "createdDate": "2023-10-27T22:38:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:CreateUser*", "connect:UpdateUser*", "connect:DeleteUser*", "connect:DescribeUser*", "connect:ListUser*", "connect:CreateRoutingProfile", "connect:UpdateRoutingProfile*", "connect:DeleteRoutingProfile", "connect:DescribeRoutingProfile", "connect:ListRoutingProfile*", "connect:CreateAgentStatus", "connect:UpdateAgentStatus", "connect:DescribeAgentStatus", "connect:ListAgentStatuses", "connect:CreateQuickConnect", "connect:UpdateQuickConnect*", "connect:DeleteQuickConnect", "connect:DescribeQuickConnect", "connect:ListQuickConnects", "connect:CreateHoursOfOperation", "connect:UpdateHoursOfOperation", "connect:DeleteHoursOfOperation", "connect:DescribeHoursOfOperation", "connect:ListHoursOfOperations", "connect:CreateQueue", "connect:UpdateQueue*", "connect:DeleteQueue", "connect:DescribeQueue", "connect:ListQueue*", "connect:CreatePrompt", "connect:UpdatePrompt", "connect:DeletePrompt", "connect:DescribePrompt", "connect:ListPrompts", "connect:GetPromptFile", "connect:CreateSecurityProfile", "connect:UpdateSecurityProfile", "connect:DeleteSecurityProfile", "connect:DescribeSecurityProfile", "connect:ListSecurityProfile*", "connect:CreateContactFlow*", "connect:UpdateContactFlow*", "connect:DeleteContactFlow*", "connect:DescribeContactFlow*", "connect:ListContactFlow*", "connect:BatchGetFlowAssociation", "connect:CreatePredefinedAttribute", "connect:UpdatePredefinedAttribute", "connect:DeletePredefinedAttribute", "connect:DescribePredefinedAttribute", "connect:ListPredefinedAttributes", "connect:ListTagsForResource", "connect:TagResource", "connect:UntagResource", "connect:ListTrafficDistributionGroups", "connect:ListPhoneNumbersV2", "connect:UpdatePhoneNumber", "connect:DescribePhoneNumber", "connect:AssociatePhoneNumberContactFlow", "connect:DisassociatePhoneNumberContactFlow", "connect:AssociateRoutingProfileQueues", "connect:DisassociateQueueQuickConnects", "connect:AssociateQueueQuickConnects", "connect:DisassociateUserProficiencies", "connect:AssociateUserProficiencies", "connect:DisassociateRoutingProfileQueues", "connect:CreateAuthenticationProfile", "connect:UpdateAuthenticationProfile", "connect:DescribeAuthenticationProfile", "connect:ListAuthenticationProfiles" ], "Resource": "*" }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v3": { "createdDate": "2023-10-27T22:38:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:CreateUser*", "connect:UpdateUser*", "connect:DeleteUser*", "connect:DescribeUser*", "connect:ListUser*", "connect:CreateRoutingProfile", "connect:UpdateRoutingProfile*", "connect:DeleteRoutingProfile", "connect:DescribeRoutingProfile", "connect:ListRoutingProfile*", "connect:CreateAgentStatus", "connect:UpdateAgentStatus", "connect:DescribeAgentStatus", "connect:ListAgentStatuses", "connect:CreateQuickConnect", "connect:UpdateQuickConnect*", "connect:DeleteQuickConnect", "connect:DescribeQuickConnect", "connect:ListQuickConnects", "connect:CreateHoursOfOperation", "connect:UpdateHoursOfOperation", "connect:DeleteHoursOfOperation", "connect:DescribeHoursOfOperation", "connect:ListHoursOfOperations", "connect:CreateQueue", "connect:UpdateQueue*", "connect:DeleteQueue", "connect:DescribeQueue", "connect:ListQueue*", "connect:CreatePrompt", "connect:UpdatePrompt", "connect:DeletePrompt", "connect:DescribePrompt", "connect:ListPrompts", "connect:GetPromptFile", "connect:CreateSecurityProfile", "connect:UpdateSecurityProfile", "connect:DeleteSecurityProfile", "connect:DescribeSecurityProfile", "connect:ListSecurityProfile*", "connect:CreateContactFlow*", "connect:UpdateContactFlow*", "connect:DeleteContactFlow*", "connect:DescribeContactFlow*", "connect:ListContactFlow*", "connect:BatchGetFlowAssociation", "connect:CreatePredefinedAttribute", "connect:UpdatePredefinedAttribute", "connect:DeletePredefinedAttribute", "connect:DescribePredefinedAttribute", "connect:ListPredefinedAttributes", "connect:ListTagsForResource", "connect:TagResource", "connect:UntagResource", "connect:ListTrafficDistributionGroups", "connect:ListPhoneNumbersV2", "connect:UpdatePhoneNumber", "connect:DescribePhoneNumber", "connect:AssociatePhoneNumberContactFlow", "connect:DisassociatePhoneNumberContactFlow", "connect:AssociateRoutingProfileQueues", "connect:DisassociateQueueQuickConnects", "connect:AssociateQueueQuickConnects", "connect:DisassociateUserProficiencies", "connect:AssociateUserProficiencies", "connect:DisassociateRoutingProfileQueues", "connect:CreateAuthenticationProfile", "connect:UpdateAuthenticationProfile", "connect:DescribeAuthenticationProfile", "connect:ListAuthenticationProfiles", "connect:CreateHoursOfOperationOverride", "connect:UpdateHoursOfOperationOverride", "connect:DeleteHoursOfOperationOverride", "connect:DescribeHoursOfOperationOverride", "connect:ListHoursOfOperationOverrides" ], "Resource": "*" }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } }, "v4": { "createdDate": "2023-10-27T22:38:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowConnectActions", "Effect": "Allow", "Action": [ "connect:Create*", "connect:Update*", "connect:Delete*", "connect:Describe*", "connect:List*", "connect:Search*", "connect:Associate*", "connect:Disassociate*", "connect:Get*", "connect:BatchGet*", "connect:TagResource", "connect:UntagResource" ], "Resource": "*" }, { "Sid": "DisallowedConnectActions", "Effect": "Deny", "Action": [ "connect:Start*", "connect:Stop*", "connect:Resume*", "connect:Suspend*", "connect:*Contact", "connect:SearchContacts", "connect:*ContactAttributes*", "connect:*RealtimeContact*", "connect:*AnalyticsData*", "connect:*MetricData*", "connect:*UserData*", "connect:*ContactEvaluation", "connect:*AttachedFile*", "connect:UpdateContactSchedule", "connect:UpdateContactRoutingData", "connect:ListContactReferences", "connect:CreateParticipant", "connect:CreatePersistentContactAssociation", "connect:CreateInstance", "connect:DeleteInstance", "connect:ListInstances", "connect:ReplicateInstance", "connect:GetFederationToken", "connect:ClaimPhoneNumber", "connect:ImportPhoneNumber", "connect:ReleasePhoneNumber", "connect:SearchAvailablePhoneNumbers", "connect:CreateTrafficDistributionGroup", "connect:DeleteTrafficDistributionGroup", "connect:GetTrafficDistribution", "connect:UpdateTrafficDistribution" ], "Resource": "*" }, { "Sid": "AllowPutMetricsForConnectNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/Connect" } } } ] } } }, "createdDate": "2023-10-27T22:38:25.000Z", "lastUpdatedDate": "2024-11-12T22:22:17.000Z" }, "AmazonSageMakerCanvasDataPrepFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasDataPrepFullAccess", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-10-27T22:56:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerListFeatureGroupOperation", "Effect": "Allow", "Action": "sagemaker:ListFeatureGroups", "Resource": "*" }, { "Sid": "SageMakerFeatureGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateFeatureGroup", "sagemaker:DescribeFeatureGroup" ], "Resource": "arn:aws:sagemaker:*:*:feature-group/*" }, { "Sid": "SageMakerProcessingJobOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateProcessingJob", "sagemaker:DescribeProcessingJob", "sagemaker:addTags" ], "Resource": "arn:aws:sagemaker:*:*:processing-job/*canvas-data-prep*" }, { "Sid": "SageMakerProcessingJobListOperation", "Effect": "Allow", "Action": "sagemaker:ListProcessingJobs", "Resource": "*" }, { "Sid": "SageMakerPipelineOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribePipeline", "sagemaker:CreatePipeline", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:StartPipelineExecution", "sagemaker:ListPipelineExecutionSteps", "sagemaker:DescribePipelineExecution" ], "Resource": "arn:aws:sagemaker:*:*:pipeline/*canvas-data-prep*" }, { "Sid": "KMSListOperations", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "*" }, { "Sid": "KMSOperations", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetObjectOperation", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "IAMListOperations", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "events.amazon.com" ] } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "sagemaker:is-canvas-data-prep-job", "sm_canvas_user_profile" ] }, "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:SearchTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "EMROperations", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*" }, { "Sid": "EMRListOperation", "Effect": "Allow", "Action": "elasticmapreduce:ListClusters", "Resource": "*" }, { "Sid": "AthenaListDataCatalogOperation", "Effect": "Allow", "Action": "athena:ListDataCatalogs", "Resource": "*" }, { "Sid": "AthenaQueryExecutionOperations", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": "arn:aws:athena:*:*:workgroup/*" }, { "Sid": "AthenaDataCatalogOperations", "Effect": "Allow", "Action": [ "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": "arn:aws:athena:*:*:datacatalog/*" }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftArnBasedOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "arn:aws:redshift:*:*:cluster:*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:TagResource", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "SageMaker" ] }, "StringEquals": { "aws:RequestTag/SageMaker": "true" } } }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/studio:*" } ] } }, "v2": { "createdDate": "2023-10-27T22:56:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerListFeatureGroupOperation", "Effect": "Allow", "Action": "sagemaker:ListFeatureGroups", "Resource": "*" }, { "Sid": "SageMakerFeatureGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateFeatureGroup", "sagemaker:DescribeFeatureGroup" ], "Resource": "arn:aws:sagemaker:*:*:feature-group/*" }, { "Sid": "SageMakerProcessingJobOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateProcessingJob", "sagemaker:DescribeProcessingJob", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:processing-job/*canvas-data-prep*" }, { "Sid": "SageMakerProcessingJobListOperation", "Effect": "Allow", "Action": "sagemaker:ListProcessingJobs", "Resource": "*" }, { "Sid": "SageMakerPipelineOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribePipeline", "sagemaker:CreatePipeline", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:StartPipelineExecution", "sagemaker:ListPipelineExecutionSteps", "sagemaker:DescribePipelineExecution" ], "Resource": "arn:aws:sagemaker:*:*:pipeline/*canvas-data-prep*" }, { "Sid": "KMSListOperations", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "*" }, { "Sid": "KMSOperations", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetObjectOperation", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "IAMListOperations", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "events.amazonaws.com" ] } } }, { "Sid": "EventBridgePutOperation", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:SearchTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "EMROperations", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*" }, { "Sid": "EMRListOperation", "Effect": "Allow", "Action": "elasticmapreduce:ListClusters", "Resource": "*" }, { "Sid": "AthenaListDataCatalogOperation", "Effect": "Allow", "Action": "athena:ListDataCatalogs", "Resource": "*" }, { "Sid": "AthenaQueryExecutionOperations", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": "arn:aws:athena:*:*:workgroup/*" }, { "Sid": "AthenaDataCatalogOperations", "Effect": "Allow", "Action": [ "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": "arn:aws:athena:*:*:datacatalog/*" }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftArnBasedOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "arn:aws:redshift:*:*:cluster:*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*", "Condition": { "StringEquals": { "aws:ResourceTag/SageMaker": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/studio:*" } ] } }, "v3": { "createdDate": "2023-10-27T22:56:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerListFeatureGroupOperation", "Effect": "Allow", "Action": "sagemaker:ListFeatureGroups", "Resource": "*" }, { "Sid": "SageMakerFeatureGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateFeatureGroup", "sagemaker:DescribeFeatureGroup" ], "Resource": "arn:aws:sagemaker:*:*:feature-group/*" }, { "Sid": "SageMakerProcessingJobOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateProcessingJob", "sagemaker:DescribeProcessingJob", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:processing-job/*canvas-data-prep*" }, { "Sid": "SageMakerProcessingJobListOperation", "Effect": "Allow", "Action": "sagemaker:ListProcessingJobs", "Resource": "*" }, { "Sid": "SageMakerPipelineOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribePipeline", "sagemaker:CreatePipeline", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:StartPipelineExecution", "sagemaker:ListPipelineExecutionSteps", "sagemaker:DescribePipelineExecution" ], "Resource": "arn:aws:sagemaker:*:*:pipeline/*canvas-data-prep*" }, { "Sid": "KMSListOperations", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "*" }, { "Sid": "KMSOperations", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetObjectOperation", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "IAMListOperations", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "events.amazonaws.com" ] } } }, { "Sid": "EventBridgePutOperation", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:SearchTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "EMROperations", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*" }, { "Sid": "EMRListOperation", "Effect": "Allow", "Action": "elasticmapreduce:ListClusters", "Resource": "*" }, { "Sid": "AthenaListDataCatalogOperation", "Effect": "Allow", "Action": "athena:ListDataCatalogs", "Resource": "*" }, { "Sid": "AthenaQueryExecutionOperations", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": "arn:aws:athena:*:*:workgroup/*" }, { "Sid": "AthenaDataCatalogOperations", "Effect": "Allow", "Action": [ "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": "arn:aws:athena:*:*:datacatalog/*" }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftArnBasedOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "arn:aws:redshift:*:*:cluster:*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*", "Condition": { "StringEquals": { "aws:ResourceTag/SageMaker": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/studio:*" }, { "Sid": "EMRServerlessCreateApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:CreateApplication", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:ListApplications", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessApplicationOperations", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:GetApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessStartJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:StartJobRun", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:ListJobRuns", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessJobRunOperations", "Effect": "Allow", "Action": [ "emr-serverless:GetJobRun", "emr-serverless:CancelJobRun" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessTagResourceOperation", "Effect": "Allow", "Action": "emr-serverless:TagResource", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassOperationForEMRServerless", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AmazonSageMakerCanvasEMRSExecutionAccess-*", "Condition": { "StringEquals": { "iam:PassedToService": "emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v4": { "createdDate": "2023-10-27T22:56:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerListFeatureGroupOperation", "Effect": "Allow", "Action": "sagemaker:ListFeatureGroups", "Resource": "*" }, { "Sid": "SageMakerFeatureGroupOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateFeatureGroup", "sagemaker:DescribeFeatureGroup" ], "Resource": "arn:aws:sagemaker:*:*:feature-group/*" }, { "Sid": "SageMakerProcessingJobOperations", "Effect": "Allow", "Action": [ "sagemaker:CreateProcessingJob", "sagemaker:DescribeProcessingJob", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:processing-job/*canvas-data-prep*" }, { "Sid": "SageMakerProcessingJobListOperation", "Effect": "Allow", "Action": "sagemaker:ListProcessingJobs", "Resource": "*" }, { "Sid": "SageMakerPipelineOperations", "Effect": "Allow", "Action": [ "sagemaker:DescribePipeline", "sagemaker:CreatePipeline", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:StartPipelineExecution", "sagemaker:ListPipelineExecutionSteps", "sagemaker:DescribePipelineExecution" ], "Resource": "arn:aws:sagemaker:*:*:pipeline/*canvas-data-prep*" }, { "Sid": "KMSListOperations", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "*" }, { "Sid": "KMSOperations", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetObjectOperation", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "IAMListOperations", "Effect": "Allow", "Action": "iam:ListRoles", "Resource": "*" }, { "Sid": "IAMGetOperations", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "IAMPassOperation", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "events.amazonaws.com" ] } } }, { "Sid": "EventBridgePutOperation", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "GlueOperations", "Effect": "Allow", "Action": [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:SearchTables" ], "Resource": [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid": "EMROperations", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*" }, { "Sid": "EMRListOperation", "Effect": "Allow", "Action": "elasticmapreduce:ListClusters", "Resource": "*" }, { "Sid": "AthenaListDataCatalogOperation", "Effect": "Allow", "Action": "athena:ListDataCatalogs", "Resource": "*" }, { "Sid": "AthenaQueryExecutionOperations", "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource": "arn:aws:athena:*:*:workgroup/*" }, { "Sid": "AthenaDataCatalogOperations", "Effect": "Allow", "Action": [ "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": "arn:aws:athena:*:*:datacatalog/*" }, { "Sid": "RedshiftOperations", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftArnBasedOperations", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "arn:aws:redshift:*:*:cluster:*" }, { "Sid": "RedshiftGetCredentialsOperation", "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "SecretsManagerARNBasedOperation", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" }, { "Sid": "SecretManagerTagBasedOperation", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*", "Condition": { "StringEquals": { "aws:ResourceTag/SageMaker": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "LoggingOperation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/studio:*" }, { "Sid": "EMRServerlessCreateApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:CreateApplication", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListApplicationOperation", "Effect": "Allow", "Action": "emr-serverless:ListApplications", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessApplicationOperations", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:GetApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessStartJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:StartJobRun", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessListJobRunOperation", "Effect": "Allow", "Action": "emr-serverless:ListJobRuns", "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessJobRunOperations", "Effect": "Allow", "Action": [ "emr-serverless:GetJobRun", "emr-serverless:CancelJobRun" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessTagResourceOperation", "Effect": "Allow", "Action": "emr-serverless:TagResource", "Resource": "arn:aws:emr-serverless:*:*:/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-resource": "True", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassOperationForEMRServerless", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerCanvasEMRSExecutionAccess-*", "arn:aws:iam::*:role/AmazonSageMakerCanvasEMRSExecutionAccess-*" ], "Condition": { "StringEquals": { "iam:PassedToService": "emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-10-27T22:56:13.000Z", "lastUpdatedDate": "2024-08-16T18:11:13.000Z" }, "AWSDataLifecycleManagerSSMFullAccess": { "arn": "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerSSMFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-10-31T20:29:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSSMReadOnlyAccess", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:ListCommands", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "AllowTaggedSSMDocumentsOnly", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/DLMScriptsAccess": "true" } } }, { "Sid": "AllowSpecificAWSOwnedSSMDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot" ] }, { "Sid": "AllowAllEC2Instances", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ] } ] } }, "v2": { "createdDate": "2023-10-31T20:29:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSSMReadOnlyAccess", "Effect": "Allow", "Action": [ "ssm:GetCommandInvocation", "ssm:ListCommands", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Sid": "AllowTaggedSSMDocumentsOnly", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/DLMScriptsAccess": "true" } } }, { "Sid": "AllowSpecificAWSOwnedSSMDocuments", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ssm:*:*:document/AWSSystemsManagerSAP-CreateDLMSnapshotForSAPHANA" ] }, { "Sid": "AllowAllEC2Instances", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ] } ] } } }, "createdDate": "2023-10-31T20:29:44.000Z", "lastUpdatedDate": "2023-11-16T22:31:54.000Z" }, "AWSIAMIdentityCenterAllowListForIdentityContext": { "arn": "arn:aws:iam::aws:policy/AWSIAMIdentityCenterAllowListForIdentityContext", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "sts:SetContext" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "sts:SetContext" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v8": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:DescribeCluster", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:ListSteps", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v9": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:DescribeCluster", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:ListSteps", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qapps:PredictQApp", "qapps:ImportDocument", "qapps:AssociateLibraryItemReview", "qapps:DisassociateLibraryItemReview", "qapps:GetQAppSession", "qapps:UpdateQAppSession", "qapps:GetQAppSessionMetadata", "qapps:UpdateQAppSessionMetadata", "qapps:TagResource", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v10": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "aoss:APIAccessAll", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:DescribeCluster", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:ListSteps", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpGet", "es:ESHttpPatch", "es:ESHttpDelete", "es:ESHttpPut", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qapps:PredictQApp", "qapps:ImportDocument", "qapps:AssociateLibraryItemReview", "qapps:DisassociateLibraryItemReview", "qapps:GetQAppSession", "qapps:UpdateQAppSession", "qapps:GetQAppSessionMetadata", "qapps:UpdateQAppSessionMetadata", "qapps:TagResource", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v11": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "aoss:APIAccessAll", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:DescribeCluster", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:ListSteps", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpGet", "es:ESHttpPatch", "es:ESHttpDelete", "es:ESHttpPut", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "s3:ListCallerAccessGrants", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qapps:PredictQApp", "qapps:ImportDocument", "qapps:AssociateLibraryItemReview", "qapps:DisassociateLibraryItemReview", "qapps:GetQAppSession", "qapps:UpdateQAppSession", "qapps:GetQAppSessionMetadata", "qapps:UpdateQAppSessionMetadata", "qapps:TagResource", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } }, "v12": { "createdDate": "2023-11-08T15:21:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TrustedIdentityPropagation", "Effect": "Deny", "NotAction": [ "aoss:APIAccessAll", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreatePreparedStatement", "athena:DeleteNamedQuery", "athena:DeletePreparedStatement", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetWorkGroup", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:UpdateNamedQuery", "athena:UpdatePreparedStatement", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListTableMetadata", "athena:ListWorkGroups", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:DescribeCluster", "elasticmapreduce:CancelSteps", "elasticmapreduce:DescribeStep", "elasticmapreduce:ListSteps", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpGet", "es:ESHttpPatch", "es:ESHttpDelete", "es:ESHttpPut", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetTableVersions", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:SearchTables", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchUpdatePartition", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "lakeformation:GetDataAccess", "s3:GetAccessGrantsInstanceForPrefix", "s3:GetDataAccess", "s3:ListCallerAccessGrants", "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "qapps:CreateQApp", "qapps:PredictProblemStatementFromConversation", "qapps:PredictQAppFromProblemStatement", "qapps:CopyQApp", "qapps:GetQApp", "qapps:ListQApps", "qapps:UpdateQApp", "qapps:DeleteQApp", "qapps:AssociateQAppWithUser", "qapps:DisassociateQAppFromUser", "qapps:ImportDocumentToQApp", "qapps:ImportDocumentToQAppSession", "qapps:CreateLibraryItem", "qapps:GetLibraryItem", "qapps:UpdateLibraryItem", "qapps:CreateLibraryItemReview", "qapps:ListLibraryItems", "qapps:CreateSubscriptionToken", "qapps:StartQAppSession", "qapps:StopQAppSession", "qapps:PredictQApp", "qapps:ImportDocument", "qapps:AssociateLibraryItemReview", "qapps:DisassociateLibraryItemReview", "qapps:GetQAppSession", "qapps:UpdateQAppSession", "qapps:GetQAppSessionMetadata", "qapps:UpdateQAppSessionMetadata", "qapps:TagResource", "qapps:ListQAppSessionData", "qapps:ExportQAppSessionData", "qbusiness:Chat", "qbusiness:ChatSync", "qbusiness:ListConversations", "qbusiness:ListMessages", "qbusiness:DeleteConversation", "qbusiness:PutFeedback", "sts:SetContext" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-08T15:21:33.000Z", "lastUpdatedDate": "2024-10-01T14:19:12.000Z" }, "CloudWatchApplicationSignalsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchApplicationSignalsServiceRolePolicy", "latestVersionId": "v6", "versionsCount": 6, "versions": { "v1": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/eks:*", "arn:aws:logs:*:*:log-group:/aws/appsignals/generic:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/*:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v3": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/*:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWListMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWGetMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v4": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/*:*", "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWListMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWGetMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v5": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/*:*", "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWListMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWGetMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2AutoScalingPermission", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v6": { "createdDate": "2023-11-09T18:09:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "XRayPermission", "Effect": "Allow", "Action": [ "xray:GetServiceGraph" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWLogsPermission", "Effect": "Allow", "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appsignals/*:*", "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWListMetricsPermission", "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CWGetMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": [ "*" ] }, { "Sid": "TagsPermission", "Effect": "Allow", "Action": [ "tag:GetResources" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ApplicationSignalsPermission", "Effect": "Allow", "Action": [ "application-signals:ListServiceLevelObjectiveExclusionWindows", "application-signals:GetServiceLevelObjective" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2AutoScalingPermission", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-11-09T18:09:57.000Z", "lastUpdatedDate": "2025-03-17T15:07:06.000Z" }, "PartnerCentralAccountManagementUserRoleAssociation": { "arn": "arn:aws:iam::aws:policy/PartnerCentralAccountManagementUserRoleAssociation", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-10T02:03:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PassPartnerCentralRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/PartnerCentralRoleFor*", "Condition": { "StringEquals": { "iam:PassedToService": "partnercentral-account-management.amazonaws.com" } } }, { "Sid": "PartnerUserRoleAssociation", "Effect": "Allow", "Action": [ "iam:ListRoles", "partnercentral-account-management:AssociatePartnerUser", "partnercentral-account-management:DisassociatePartnerUser" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-10T02:03:40.000Z", "lastUpdatedDate": "2023-11-10T02:03:40.000Z" }, "AWSServiceRolePolicyForBackupRestoreTesting": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRolePolicyForBackupRestoreTesting", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-10T23:37:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BackupActions", "Effect": "Allow", "Action": [ "backup:DescribeRestoreJob", "backup:GetRecoveryPointRestoreMetadata", "backup:ListBackupVaults", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "backup:StartRestoreJob" ], "Resource": "*" }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Sid": "DescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeVolumes", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:ListTagsForResource" ], "Resource": "*" }, { "Sid": "DeleteActions", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:TerminateInstances", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:DeleteMountTarget", "rds:DeleteDBCluster", "rds:DeleteDBInstance", "fsx:DeleteFileSystem", "fsx:DeleteVolume" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/awsbackup-restore-test": "false" } } }, { "Sid": "DdbDeleteActions", "Effect": "Allow", "Action": [ "dynamodb:DeleteTable", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/awsbackup-restore-test-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3DeleteActions", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::awsbackup-restore-test-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2023-11-10T23:37:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BackupActions", "Effect": "Allow", "Action": [ "backup:DescribeRecoveryPoint", "backup:DescribeRestoreJob", "backup:DescribeProtectedResource", "backup:GetRecoveryPointRestoreMetadata", "backup:ListBackupVaults", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByResource", "backup:ListTags", "backup:StartRestoreJob" ], "Resource": "*" }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "backup.amazonaws.com" } } }, { "Sid": "DescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeSnapshotTierStatus", "ec2:DescribeTags", "ec2:DescribeVolumes", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "fsx:DescribeVolumes", "fsx:ListTagsForResource", "rds:DescribeDBInstances", "rds:DescribeDBClusters", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBClusterAutomatedBackups", "rds:ListTagsForResource", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "DeleteActions", "Effect": "Allow", "Action": [ "ec2:DeleteVolume", "ec2:TerminateInstances", "elasticfilesystem:DeleteFilesystem", "elasticfilesystem:DeleteMountTarget", "rds:DeleteDBCluster", "rds:DeleteDBInstance", "fsx:DeleteFileSystem", "fsx:DeleteVolume" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/awsbackup-restore-test": "false" } } }, { "Sid": "DdbDeleteActions", "Effect": "Allow", "Action": [ "dynamodb:DeleteTable", "dynamodb:DescribeTable" ], "Resource": "arn:aws:dynamodb:*:*:table/awsbackup-restore-test-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftDeleteActions", "Effect": "Allow", "Action": "redshift:DeleteCluster", "Resource": "arn:aws:redshift:*:*:cluster:awsbackup-restore-test-*" }, { "Sid": "S3DeleteActions", "Effect": "Allow", "Action": [ "s3:DeleteBucket", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration" ], "Resource": "arn:aws:s3:::awsbackup-restore-test-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TimestreamDeleteActions", "Effect": "Allow", "Action": "timestream:DeleteTable", "Resource": "arn:aws:timestream:*:*:database/*/table/awsbackup-restore-test-*" } ] } } }, "createdDate": "2023-11-10T23:37:45.000Z", "lastUpdatedDate": "2024-02-14T22:42:37.000Z" }, "AWSIncidentManagerIncidentAccessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSIncidentManagerIncidentAccessServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-13T00:01:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IncidentAccessPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "codedeploy:BatchGetDeployments", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-11-13T00:01:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IncidentAccessPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "codedeploy:BatchGetDeployments", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "autoscaling:DescribeAutoScalingInstances" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-13T00:01:23.000Z", "lastUpdatedDate": "2024-02-20T23:02:11.000Z" }, "AWSIoTTwinMakerServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIoTTwinMakerServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-13T18:59:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SiteWiseAssetReadAccess", "Effect": "Allow", "Action": [ "iotsitewise:DescribeAsset" ], "Resource": [ "arn:aws:iotsitewise:*:*:asset/*" ] }, { "Sid": "SiteWiseAssetModelReadAccess", "Effect": "Allow", "Action": [ "iotsitewise:DescribeAssetModel" ], "Resource": [ "arn:aws:iotsitewise:*:*:asset-model/*" ] }, { "Sid": "SiteWiseAssetModelAndAssetListAccess", "Effect": "Allow", "Action": [ "iotsitewise:ListAssets", "iotsitewise:ListAssetModels" ], "Resource": [ "*" ] }, { "Sid": "TwinMakerAccess", "Effect": "Allow", "Action": [ "iottwinmaker:GetEntity", "iottwinmaker:CreateEntity", "iottwinmaker:UpdateEntity", "iottwinmaker:DeleteEntity", "iottwinmaker:ListEntities", "iottwinmaker:GetComponentType", "iottwinmaker:CreateComponentType", "iottwinmaker:UpdateComponentType", "iottwinmaker:DeleteComponentType", "iottwinmaker:ListComponentTypes" ], "Resource": [ "arn:aws:iottwinmaker:*:*:workspace/*" ], "Condition": { "ForAnyValue:StringEquals": { "iottwinmaker:linkedServices": [ "IOTSITEWISE" ] } } } ] } } }, "createdDate": "2023-11-13T18:59:42.000Z", "lastUpdatedDate": "2023-11-13T18:59:42.000Z" }, "AWSResourceExplorerOrganizationsAccess": { "arn": "arn:aws:iam::aws:policy/AWSResourceExplorerOrganizationsAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-14T17:01:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyAccess", "Effect": "Allow", "Action": [ "resource-explorer-2:*", "ec2:DescribeRegions", "ram:ListResources", "ram:GetResourceShares", "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "ResourceExplorerGetSLRAccess", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer" }, { "Sid": "ResourceExplorerCreateSLRAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "resource-explorer-2.amazonaws.com" ] } } }, { "Sid": "OrganizationsAdministratorAccess", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:DisableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "resource-explorer-2.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-11-14T17:01:12.000Z", "lastUpdatedDate": "2023-11-14T17:01:12.000Z" }, "AWSrePostPrivateCloudWatchAccess": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSrePostPrivateCloudWatchAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-15T16:37:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchPublishMetrics", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/rePostPrivate", "AWS/Usage" ] } } } ] } } }, "createdDate": "2023-11-15T16:37:33.000Z", "lastUpdatedDate": "2023-11-15T16:37:33.000Z" }, "AWSMarketplaceDeploymentServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceDeploymentServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-15T23:34:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ManageMarketplaceDeploymentSecrets", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:RemoveRegionsFromReplication" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:marketplace-deployment*!*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListSecrets", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ] }, { "Sid": "TagMarketplaceDeploymentSecrets", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:marketplace-deployment!*", "Condition": { "Null": { "aws:RequestTag/expirationDate": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "expirationDate" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-11-15T23:34:33.000Z", "lastUpdatedDate": "2023-11-15T23:34:33.000Z" }, "AWSGitSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSGitSyncServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-16T17:05:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessGitRepos", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2023-11-16T17:05:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessGitRepos", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-11-16T17:05:42.000Z", "lastUpdatedDate": "2024-04-26T18:12:31.000Z" }, "EC2ImageBuilderLifecycleExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/EC2ImageBuilderLifecycleExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-16T23:23:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "Ec2ImagePermission", "Effect": "Allow", "Action": [ "ec2:EnableImage", "ec2:DeregisterImage", "ec2:EnableImageDeprecation", "ec2:DescribeImageAttribute", "ec2:DisableImage", "ec2:DisableImageDeprecation" ], "Resource": "arn:aws:ec2:*::image/*", "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Sid": "EC2DeleteSnapshotPermission", "Effect": "Allow", "Action": "ec2:DeleteSnapshot", "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "EC2 Image Builder" } } }, { "Sid": "EC2TagsPermission", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*::image/*" ], "Condition": { "StringEquals": { "aws:RequestTag/DeprecatedBy": "EC2 Image Builder", "aws:ResourceTag/CreatedBy": "EC2 Image Builder" }, "ForAllValues:StringEquals": { "aws:TagKeys": "DeprecatedBy" } } }, { "Sid": "ECRImagePermission", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchDeleteImage" ], "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "StringEquals": { "ecr:ResourceTag/LifecycleExecutionAccess": "EC2 Image Builder" } } }, { "Sid": "ImageBuilderEC2TagServicePermission", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "tag:GetResources", "imagebuilder:DeleteImage" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-16T23:23:09.000Z", "lastUpdatedDate": "2023-11-16T23:23:09.000Z" }, "AmazonInspector2AgentlessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2AgentlessServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-20T15:18:32.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "InstanceIdentification", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Sid": "GetSnapshotData", "Effect": "Allow", "Action": [ "ebs:ListSnapshotBlocks", "ebs:GetSnapshotBlock" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "aws:ResourceTag/InspectorScan": "*" } } }, { "Sid": "CreateSnapshotsAnyInstanceOrVolume", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "DenyCreateSnapshotsOnExcludedInstances", "Effect": "Deny", "Action": "ec2:CreateSnapshots", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/InspectorEc2Exclusion": "true" } } }, { "Sid": "CreateSnapshotsOnAnySnapshotOnlyWithTag", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": "InspectorScan" } } }, { "Sid": "CreateOnlyInspectorScanTagOnlyUsingCreateSnapshots", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:CreateAction": "CreateSnapshots" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": "InspectorScan" } } }, { "Sid": "DeleteOnlySnapshotsTaggedForScanning", "Effect": "Allow", "Action": "ec2:DeleteSnapshot", "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringLike": { "ec2:ResourceTag/InspectorScan": "*" } } }, { "Sid": "DenyKmsDecryptForExcludedKeys", "Effect": "Deny", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/InspectorEc2Exclusion": "true" } } }, { "Sid": "DecryptSnapshotBlocksVolContext", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com", "kms:EncryptionContext:aws:ebs:id": "vol-*" } } }, { "Sid": "DecryptSnapshotBlocksSnapContext", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com", "kms:EncryptionContext:aws:ebs:id": "snap-*" } } }, { "Sid": "DescribeKeysForEbsOperations", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" } } }, { "Sid": "ListKeyResourceTags", "Effect": "Allow", "Action": "kms:ListResourceTags", "Resource": "arn:aws:kms:*:*:key/*" } ] } } }, "createdDate": "2023-11-20T15:18:32.000Z", "lastUpdatedDate": "2023-11-20T15:18:32.000Z" }, "CostOptimizationHubServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CostOptimizationHubServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-26T08:03:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListParents", "organizations:DescribeOrganizationalUnit" ], "Resource": [ "*" ] }, { "Sid": "CostExplorerAccess", "Effect": "Allow", "Action": [ "ce:ListCostAllocationTags" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2023-11-26T08:03:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsOrgsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListParents", "organizations:DescribeOrganizationalUnit" ], "Resource": [ "*" ] }, { "Sid": "AwsOrgsScopedAccess", "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:ServicePrincipal": [ "cost-optimization-hub.bcm.amazonaws.com" ] } } }, { "Sid": "CostExplorerAccess", "Effect": "Allow", "Action": [ "ce:ListCostAllocationTags", "ce:GetCostAndUsage" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2023-11-26T08:03:59.000Z", "lastUpdatedDate": "2024-07-05T18:02:53.000Z" }, "AmazonPrometheusScraperServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonPrometheusScraperServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-26T14:19:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/scraper.aps.amazonaws.com/AWSServiceRoleForAmazonPrometheusScraper*" }, { "Sid": "NetworkDiscovery", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "ENIManagement", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AMPAgentlessScraper" ] } } }, { "Sid": "TagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:*:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "Null": { "aws:RequestTag/AMPAgentlessScraper": "false" } } }, { "Sid": "ENIUpdating", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AMPAgentlessScraper": "false" } } }, { "Sid": "EKSAccess", "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "arn:*:eks:*:*:cluster/*" }, { "Sid": "APSWriting", "Effect": "Allow", "Action": "aps:RemoteWrite", "Resource": "arn:*:aps:*:*:workspace/*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } }, "v2": { "createdDate": "2023-11-26T14:19:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeleteSLR", "Effect": "Allow", "Action": [ "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/scraper.aps.amazonaws.com/AWSServiceRoleForAmazonPrometheusScraper*" }, { "Sid": "NetworkDiscovery", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "ENIManagement", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AMPAgentlessScraper" ] } } }, { "Sid": "TagManagement", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" }, "Null": { "aws:RequestTag/AMPAgentlessScraper": "false" } } }, { "Sid": "ENIUpdating", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": "*", "Condition": { "Null": { "ec2:ResourceTag/AMPAgentlessScraper": "false" } } }, { "Sid": "EKSAccess", "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "arn:aws:eks:*:*:cluster/*" }, { "Sid": "DeleteEKSAccessEntry", "Effect": "Allow", "Action": "eks:DeleteAccessEntry", "Resource": "arn:aws:eks:*:*:access-entry/*/role/*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" }, "ArnLike": { "eks:principalArn": "arn:aws:iam::*:role/aws-service-role/scraper.aps.amazonaws.com/AWSServiceRoleForAmazonPrometheusScraper*" } } }, { "Sid": "APSWriting", "Effect": "Allow", "Action": "aps:RemoteWrite", "Resource": "arn:aws:aps:*:*:workspace/*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2023-11-26T14:19:52.000Z", "lastUpdatedDate": "2024-04-26T20:25:54.000Z" }, "AWSRepostSpaceSupportOperationsPolicy": { "arn": "arn:aws:iam::aws:policy/AWSRepostSpaceSupportOperationsPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-26T21:52:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RepostSpaceSupportOperations", "Effect": "Allow", "Action": [ "support:AddAttachmentsToSet", "support:AddCommunicationToCase", "support:CreateCase", "support:DescribeCases", "support:DescribeCommunications", "support:ResolveCase" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-26T21:52:15.000Z", "lastUpdatedDate": "2023-11-26T21:52:15.000Z" }, "AWSElasticDisasterRecoveryConsoleFullAccess_v2": { "arn": "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryConsoleFullAccess_v2", "latestVersionId": "v4", "versionsCount": 4, "versions": { "v1": { "createdDate": "2023-11-27T13:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess30", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess31", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess32", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess33", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess34", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ConsoleFullAccess35", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ConsoleFullAccess36", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": [ "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess37", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v2": { "createdDate": "2023-11-27T13:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess30", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:DescribeParameters" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess31", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess32", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess33", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess34", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ConsoleFullAccess35", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ConsoleFullAccess36", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": [ "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess37", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } } ] } }, "v3": { "createdDate": "2023-11-27T13:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts", "ec2:GetInstanceTypesFromInstanceRequirements" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess30", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:DescribeParameters" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess31", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess32", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess33", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess34", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ConsoleFullAccess35", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ConsoleFullAccess36", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": [ "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess37", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess38", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess39", "Effect": "Allow", "Action": "ec2:CreateFleet", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess40", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateFleet" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } } ] } }, "v4": { "createdDate": "2023-11-27T13:35:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsoleFullAccess1", "Effect": "Allow", "Action": [ "drs:*" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess2", "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess3", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:GetEbsEncryptionByDefault", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeKeyPairs", "ec2:DescribeCapacityReservations", "ec2:DescribeHosts", "ec2:GetInstanceTypesFromInstanceRequirements" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess4", "Effect": "Allow", "Action": "license-manager:ListLicenseConfigurations", "Resource": "*" }, { "Sid": "ConsoleFullAccess5", "Effect": "Allow", "Action": "resource-groups:ListGroups", "Resource": "*" }, { "Sid": "ConsoleFullAccess6", "Effect": "Allow", "Action": "elasticloadbalancing:DescribeLoadBalancers", "Resource": "*" }, { "Sid": "ConsoleFullAccess7", "Effect": "Allow", "Action": [ "iam:ListInstanceProfiles", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess8", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole", "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess9", "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess10", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess11", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess12", "Effect": "Allow", "Action": [ "ec2:DeleteVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess13", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:ModifyInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess14", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess15", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess16", "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Sid": "ConsoleFullAccess17", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess18", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess19", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess20", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess21", "Effect": "Allow", "Action": [ "ec2:DetachVolume", "ec2:AttachVolume", "ec2:StartInstances", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess22", "Effect": "Allow", "Action": [ "ec2:AttachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess23", "Effect": "Allow", "Action": [ "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess24", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess25", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess26", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", "RunInstances", "CreateNetworkInterface" ] }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess27", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateLaunchTemplate" ] } } }, { "Sid": "ConsoleFullAccess28", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess29", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess30", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:DescribeParameters" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess31", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT", "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity", "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes", "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse", "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess32", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess33", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "ConsoleFullAccess34", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ConsoleFullAccess35", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ConsoleFullAccess36", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": [ "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "ConsoleFullAccess37", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "ConsoleFullAccess38", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess39", "Effect": "Allow", "Action": "ec2:CreateFleet", "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:image/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess40", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateFleet" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "ConsoleFullAccess41", "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess42", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "ConsoleFullAccess43", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "ConsoleFullAccess44", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" }, "Bool": { "aws:ViaAWSService": "true" } } } ] } } }, "createdDate": "2023-11-27T13:35:19.000Z", "lastUpdatedDate": "2025-01-05T15:22:06.000Z" }, "AmazonOneEnterpriseFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOneEnterpriseFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-28T04:58:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "FullAccessStatementID", "Effect": "Allow", "Action": [ "one:*" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-28T04:58:21.000Z", "lastUpdatedDate": "2023-11-28T04:58:21.000Z" }, "AmazonOneEnterpriseReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOneEnterpriseReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-28T04:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyAccessStatementID", "Effect": "Allow", "Action": [ "one:Get*", "one:List*" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-28T04:59:23.000Z", "lastUpdatedDate": "2023-11-28T04:59:23.000Z" }, "AmazonOneEnterpriseInstallerAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOneEnterpriseInstallerAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-28T05:00:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "InstallerAccessStatementID", "Effect": "Allow", "Action": [ "one:CreateDeviceActivationQrCode", "one:GetDeviceInstance", "one:GetSite", "one:GetSiteAddress", "one:ListDeviceInstances", "one:ListSites" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-28T05:00:39.000Z", "lastUpdatedDate": "2023-11-28T05:00:39.000Z" }, "AmazonQFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonQFullAccess", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2023-11-28T16:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQFullAccess", "Effect": "Allow", "Action": [ "q:*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-11-28T16:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQFullAccess", "Effect": "Allow", "Action": [ "q:*" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } }, "v3": { "createdDate": "2023-11-28T16:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQFullAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetadata", "q:CreateAssignment", "q:DeleteAssignment" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } }, "v4": { "createdDate": "2023-11-28T16:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQFullAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetadata", "q:CreateAssignment", "q:DeleteAssignment", "q:GenerateCodeFromCommands" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } }, "v5": { "createdDate": "2023-11-28T16:00:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQFullAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetadata", "q:CreateAssignment", "q:DeleteAssignment", "q:GenerateCodeFromCommands", "q:CreatePlugin", "q:DeletePlugin", "q:GetPlugin", "q:UsePlugin", "q:ListPlugins", "q:ListPluginProviders", "q:ListTagsForResource", "q:UntagResource", "q:TagResource" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "AllowPassRoleToAmazonQ", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "q.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-11-28T16:00:24.000Z", "lastUpdatedDate": "2024-11-13T21:51:39.000Z" }, "AWSServiceRoleForNeptuneGraphPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForNeptuneGraphPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-29T14:03:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GraphMetrics", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Neptune", "AWS/Usage" ] } } }, { "Sid": "GraphLogGroup", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/neptune/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GraphLogEvents", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2023-11-29T14:03:36.000Z", "lastUpdatedDate": "2023-11-29T14:03:36.000Z" }, "AmazonSageMakerClusterInstanceRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerClusterInstanceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-29T15:11:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudwatchLogStreamPublishPermissions", "Effect": "Allow", "Action": [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*:log-stream:*" ] }, { "Sid": "CloudwatchLogGroupCreationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*" ] }, { "Sid": "CloudwatchPutMetricDataAccess", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "cloudwatch:namespace": "/aws/sagemaker/Clusters" } } }, { "Sid": "DataRetrievalFromS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SSMConnectivityPermissions", "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-29T15:11:26.000Z", "lastUpdatedDate": "2023-11-29T15:11:26.000Z" }, "AWSZonalAutoshiftPracticeRunSLRPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSZonalAutoshiftPracticeRunSLRPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-29T17:34:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "MonitoringPermissions", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms", "health:DescribeEvents" ], "Resource": "*" }, { "Sid": "ZonalShiftManagementPermissions", "Effect": "Allow", "Action": [ "arc-zonal-shift:CancelZonalShift", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:StartZonalShift", "arc-zonal-shift:UpdateZonalShift" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-29T17:34:54.000Z", "lastUpdatedDate": "2023-11-29T17:34:54.000Z" }, "AWSCleanRoomsMLReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-29T20:55:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsConsoleNavigation", "Effect": "Allow", "Action": [ "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetMembership", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource" ], "Resource": "*" }, { "Sid": "CleanRoomsMLRead", "Effect": "Allow", "Action": [ "cleanrooms-ml:Get*", "cleanrooms-ml:List*" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-11-29T20:55:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsConsoleNavigation", "Effect": "Allow", "Action": [ "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetMembership", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource" ], "Resource": "*" }, { "Sid": "CleanRoomsMLRead", "Effect": "Allow", "Action": [ "cleanrooms-ml:Get*", "cleanrooms-ml:List*" ], "Resource": "*" }, { "Sid": "PassCleanRoomsResources", "Effect": "Allow", "Action": [ "cleanrooms:PassMembership", "cleanrooms:PassCollaboration" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-29T20:55:31.000Z", "lastUpdatedDate": "2025-01-10T20:52:06.000Z" }, "AWSCleanRoomsMLFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSCleanRoomsMLFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-11-29T21:02:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsMLFullAccess", "Effect": "Allow", "Action": [ "cleanrooms-ml:*" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/cleanrooms-ml*" ], "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms-ml.amazonaws.com" } } }, { "Sid": "CleanRoomsConsoleNavigation", "Effect": "Allow", "Action": [ "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetMembership", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource" ], "Resource": "*" }, { "Sid": "CollaborationMembershipCheck", "Effect": "Allow", "Action": [ "cleanrooms:ListMembers" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cleanrooms-ml.amazonaws.com" ] } } }, { "Sid": "AssociateModels", "Effect": "Allow", "Action": [ "cleanrooms:CreateConfiguredAudienceModelAssociation" ], "Resource": "*" }, { "Sid": "TagAssociations", "Effect": "Allow", "Action": [ "cleanrooms:TagResource" ], "Resource": "arn:aws:cleanrooms:*:*:membership/*/configuredaudiencemodelassociation/*" }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/service-role/cleanrooms-ml*", "arn:aws:iam::*:role/role/cleanrooms-ml*" ] }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanroomsml*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "ConsolePickOutputBucket", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsolePickS3Location", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*cleanrooms-ml*" } ] } }, "v2": { "createdDate": "2023-11-29T21:02:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CleanRoomsMLFullAccess", "Effect": "Allow", "Action": [ "cleanrooms-ml:*" ], "Resource": "*" }, { "Sid": "PassServiceRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/cleanrooms-ml*" ], "Condition": { "StringEquals": { "iam:PassedToService": "cleanrooms-ml.amazonaws.com" } } }, { "Sid": "CleanRoomsConsoleNavigation", "Effect": "Allow", "Action": [ "cleanrooms:GetCollaboration", "cleanrooms:BatchGetSchema", "cleanrooms:GetConfiguredAudienceModelAssociation", "cleanrooms:GetMembership", "cleanrooms:ListAnalysisTemplates", "cleanrooms:ListCollaborationAnalysisTemplates", "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations", "cleanrooms:ListCollaborations", "cleanrooms:ListConfiguredTableAssociations", "cleanrooms:ListConfiguredTables", "cleanrooms:ListMembers", "cleanrooms:ListMemberships", "cleanrooms:ListProtectedQueries", "cleanrooms:ListSchemas", "cleanrooms:ListTagsForResource" ], "Resource": "*" }, { "Sid": "CollaborationMembershipCheck", "Effect": "Allow", "Action": [ "cleanrooms:ListMembers" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cleanrooms-ml.amazonaws.com" ] } } }, { "Sid": "AssociateModels", "Effect": "Allow", "Action": [ "cleanrooms:CreateConfiguredAudienceModelAssociation" ], "Resource": "*" }, { "Sid": "TagAssociations", "Effect": "Allow", "Action": [ "cleanrooms:TagResource" ], "Resource": "arn:aws:cleanrooms:*:*:membership/*/configuredaudiencemodelassociation/*" }, { "Sid": "ListRolesToPickServiceRole", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "GetRoleAndListRolePoliciesToInspectServiceRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/service-role/cleanrooms-ml*", "arn:aws:iam::*:role/role/cleanrooms-ml*" ] }, { "Sid": "ListPoliciesToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GetPolicyToInspectServiceRolePolicy", "Effect": "Allow", "Action": [ "iam:GetPolicy", "iam:GetPolicyVersion" ], "Resource": "arn:aws:iam::*:policy/*cleanroomsml*" }, { "Sid": "ConsoleDisplayTables", "Effect": "Allow", "Action": [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:GetSchema", "glue:GetSchemaVersion", "glue:BatchGetPartition" ], "Resource": "*" }, { "Sid": "ConsolePickOutputBucket", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "ConsolePickS3Location", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*cleanrooms-ml*" }, { "Sid": "ConsoleDescribeECRRepositories", "Effect": "Allow", "Action": [ "ecr:DescribeRepositories", "ecr:ListImages" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "PassCleanRoomsResources", "Effect": "Allow", "Action": [ "cleanrooms:PassMembership", "cleanrooms:PassCollaboration" ], "Resource": "*" } ] } } }, "createdDate": "2023-11-29T21:02:06.000Z", "lastUpdatedDate": "2025-01-10T20:07:07.000Z" }, "NeptuneGraphReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/NeptuneGraphReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-11-30T07:32:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyPermissionsForNeptuneGraph", "Effect": "Allow", "Action": [ "neptune-graph:Get*", "neptune-graph:List*", "neptune-graph:Read*" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForEC2", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForKMS", "Effect": "Allow", "Action": [ "kms:ListKeys", "kms:ListAliases" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForCloudwatch", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AllowReadOnlyPermissionsForLogs", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/neptune/*:log-stream:*" ] } ] } } }, "createdDate": "2023-11-30T07:32:17.000Z", "lastUpdatedDate": "2023-11-30T07:32:17.000Z" }, "IVSReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/IVSReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2023-12-05T18:00:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IVSReadOnlyAccess", "Effect": "Allow", "Action": [ "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-12-05T18:00:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IVSReadOnlyAccess", "Effect": "Allow", "Action": [ "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-12-05T18:00:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IVSReadOnlyAccess", "Effect": "Allow", "Action": [ "ivs:BatchGetChannel", "ivs:GetChannel", "ivs:GetComposition", "ivs:GetEncoderConfiguration", "ivs:GetIngestConfiguration", "ivs:GetParticipant", "ivs:GetPlaybackKeyPair", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetPublicKey", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:GetStageSession", "ivs:GetStorageConfiguration", "ivs:GetStream", "ivs:GetStreamSession", "ivs:ListChannels", "ivs:ListCompositions", "ivs:ListEncoderConfigurations", "ivs:ListIngestConfigurations", "ivs:ListParticipants", "ivs:ListParticipantEvents", "ivs:ListPlaybackKeyPairs", "ivs:ListPlaybackRestrictionPolicies", "ivs:ListPublicKeys", "ivs:ListRecordingConfigurations", "ivs:ListStages", "ivs:ListStageSessions", "ivs:ListStorageConfigurations", "ivs:ListStreamKeys", "ivs:ListStreams", "ivs:ListStreamSessions", "ivs:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2023-12-05T18:00:37.000Z", "lastUpdatedDate": "2024-09-17T20:42:06.000Z" }, "AWSMSKReplicatorExecutionRole": { "arn": "arn:aws:iam::aws:policy/service-role/AWSMSKReplicatorExecutionRole", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-12-06T00:07:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ClusterPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:Connect", "kafka-cluster:DescribeCluster", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:AlterTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:AlterGroup", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:AlterTopicDynamicConfiguration" ], "Resource": [ "arn:aws:kafka:*:*:cluster/*" ] }, { "Sid": "TopicPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:AlterTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:AlterTopicDynamicConfiguration", "kafka-cluster:AlterCluster" ], "Resource": [ "arn:aws:kafka:*:*:topic/*/*" ] }, { "Sid": "GroupPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:AlterGroup", "kafka-cluster:DescribeGroup" ], "Resource": [ "arn:aws:kafka:*:*:group/*/*" ] } ] } }, "v2": { "createdDate": "2023-12-06T00:07:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ClusterPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:Connect", "kafka-cluster:DescribeCluster", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:AlterTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:AlterGroup", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:AlterTopicDynamicConfiguration", "kafka-cluster:WriteDataIdempotently" ], "Resource": [ "arn:aws:kafka:*:*:cluster/*" ] }, { "Sid": "TopicPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:AlterTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:AlterTopicDynamicConfiguration", "kafka-cluster:AlterCluster" ], "Resource": [ "arn:aws:kafka:*:*:topic/*/*" ] }, { "Sid": "GroupPermissions", "Effect": "Allow", "Action": [ "kafka-cluster:AlterGroup", "kafka-cluster:DescribeGroup" ], "Resource": [ "arn:aws:kafka:*:*:group/*/*" ] } ] } } }, "createdDate": "2023-12-06T00:07:52.000Z", "lastUpdatedDate": "2024-03-25T21:36:08.000Z" }, "AmazonBedrockFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonBedrockFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2023-12-06T15:47:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockAll", "Effect": "Allow", "Action": [ "bedrock:*" ], "Resource": "*" }, { "Sid": "DescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:*:kms:*:::*" }, { "Sid": "APIsWithAllResourceAccess", "Effect": "Allow", "Action": [ "iam:ListRoles", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "PassRoleToBedrock", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonBedrock*", "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2023-12-06T15:47:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockAll", "Effect": "Allow", "Action": [ "bedrock:*" ], "Resource": "*" }, { "Sid": "DescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:*:kms:*:::*" }, { "Sid": "APIsWithAllResourceAccess", "Effect": "Allow", "Action": [ "iam:ListRoles", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "MarketplaceModelEndpointMutatingAPIs", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com", "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" } } }, { "Sid": "MarketplaceModelEndpointAddTagsOperations", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "sagemaker-sdk:bedrock", "bedrock:marketplace-registration-status", "sagemaker-studio:hub-content-arn" ] }, "StringLike": { "aws:RequestTag/sagemaker-sdk:bedrock": "compatible", "aws:RequestTag/bedrock:marketplace-registration-status": "registered", "aws:RequestTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" } } }, { "Sid": "MarketplaceModelEndpointDeleteTagsOperations", "Effect": "Allow", "Action": [ "sagemaker:DeleteTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "sagemaker-sdk:bedrock", "bedrock:marketplace-registration-status", "sagemaker-studio:hub-content-arn" ] }, "StringLike": { "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible", "aws:ResourceTag/bedrock:marketplace-registration-status": "registered", "aws:ResourceTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" } } }, { "Sid": "MarketplaceModelEndpointNonMutatingAPIs", "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com" } } }, { "Sid": "MarketplaceModelEndpointInvokingOperations", "Effect": "Allow", "Action": [ "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointWithResponseStream" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com", "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" } } }, { "Sid": "DiscoveringMarketplaceModel", "Effect": "Allow", "Action": [ "sagemaker:DescribeHubContent" ], "Resource": [ "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" ] }, { "Sid": "AllowMarketplaceModelsListing", "Effect": "Allow", "Action": [ "sagemaker:ListHubContents" ], "Resource": "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" }, { "Sid": "PassRoleToSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*SageMaker*ForBedrock*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "bedrock.amazonaws.com" ] } } }, { "Sid": "PassRoleToBedrock", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/*AmazonBedrock*", "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-12-06T15:47:17.000Z", "lastUpdatedDate": "2024-12-04T19:51:07.000Z" }, "AmazonBedrockReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonBedrockReadOnly", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2023-12-06T15:48:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonBedrockReadOnly", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:ListFoundationModels", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:ListProvisionedModelThroughputs", "bedrock:GetModelCustomizationJob", "bedrock:ListModelCustomizationJobs", "bedrock:ListCustomModels", "bedrock:GetCustomModel", "bedrock:ListTagsForResource", "bedrock:GetFoundationModelAvailability" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2023-12-06T15:48:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonBedrockReadOnly", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:ListFoundationModels", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:ListProvisionedModelThroughputs", "bedrock:GetModelCustomizationJob", "bedrock:ListModelCustomizationJobs", "bedrock:ListCustomModels", "bedrock:GetCustomModel", "bedrock:ListTagsForResource", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:ListGuardrails", "bedrock:GetEvaluationJob", "bedrock:ListEvaluationJobs", "bedrock:GetModelInvocationJob", "bedrock:ListModelInvocationJobs" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2023-12-06T15:48:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonBedrockReadOnly", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:ListFoundationModels", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:ListProvisionedModelThroughputs", "bedrock:GetModelCustomizationJob", "bedrock:ListModelCustomizationJobs", "bedrock:ListCustomModels", "bedrock:GetCustomModel", "bedrock:ListTagsForResource", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:ListGuardrails", "bedrock:GetEvaluationJob", "bedrock:ListEvaluationJobs", "bedrock:GetModelInvocationJob", "bedrock:ListModelInvocationJobs", "bedrock:GetInferenceProfile", "bedrock:ListInferenceProfiles" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2023-12-06T15:48:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonBedrockReadOnly", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:ListFoundationModels", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetProvisionedModelThroughput", "bedrock:ListProvisionedModelThroughputs", "bedrock:GetModelCustomizationJob", "bedrock:ListModelCustomizationJobs", "bedrock:ListCustomModels", "bedrock:GetCustomModel", "bedrock:ListTagsForResource", "bedrock:GetFoundationModelAvailability", "bedrock:GetGuardrail", "bedrock:ListGuardrails", "bedrock:GetEvaluationJob", "bedrock:ListEvaluationJobs", "bedrock:GetModelInvocationJob", "bedrock:ListModelInvocationJobs", "bedrock:GetInferenceProfile", "bedrock:ListInferenceProfiles", "bedrock:ListImportedModels", "bedrock:GetImportedModel", "bedrock:ListModelImportJobs", "bedrock:GetModelImportJob" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2023-12-06T15:48:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonBedrockReadOnly", "Effect": "Allow", "Action": [ "bedrock:Get*", "bedrock:List*" ], "Resource": "*" }, { "Sid": "MarketplaceModelEndpointNonMutatingAPIs", "Effect": "Allow", "Action": [ "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeInferenceComponent", "sagemaker:ListEndpoints", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com" } } }, { "Sid": "DiscoveringMarketplaceModel", "Effect": "Allow", "Action": [ "sagemaker:DescribeHubContent" ], "Resource": [ "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" ] }, { "Sid": "AllowMarketplaceModelsListing", "Effect": "Allow", "Action": [ "sagemaker:ListHubContents" ], "Resource": "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" } ] } } }, "createdDate": "2023-12-06T15:48:19.000Z", "lastUpdatedDate": "2024-12-04T19:36:07.000Z" }, "CostOptimizationHubReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CostOptimizationHubReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-12-13T18:04:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CostOptimizationHubReadOnlyAccess", "Effect": "Allow", "Action": [ "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries" ], "Resource": "*" } ] } } }, "createdDate": "2023-12-13T18:04:15.000Z", "lastUpdatedDate": "2023-12-13T18:04:15.000Z" }, "IVSFullAccess": { "arn": "arn:aws:iam::aws:policy/IVSFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-12-13T21:20:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "IVSFullAccess", "Effect": "Allow", "Action": [ "ivs:*", "ivschat:*" ], "Resource": "*" } ] } } }, "createdDate": "2023-12-13T21:20:21.000Z", "lastUpdatedDate": "2023-12-13T21:20:21.000Z" }, "CostOptimizationHubAdminAccess": { "arn": "arn:aws:iam::aws:policy/CostOptimizationHubAdminAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-12-19T00:03:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CostOptimizationHubAdminAccess", "Effect": "Allow", "Action": [ "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:UpdateEnrollmentStatus", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:UpdatePreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries" ], "Resource": "*" }, { "Sid": "AllowCreationOfServiceLinkedRoleForCostOptimizationHub", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub" ], "Condition": { "StringLike": { "iam:AWSServiceName": "cost-optimization-hub.bcm.amazonaws.com" } } }, { "Sid": "AllowAWSServiceAccessForCostOptimizationHub", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringLike": { "organizations:ServicePrincipal": [ "cost-optimization-hub.bcm.amazonaws.com" ] } } } ] } } }, "createdDate": "2023-12-19T00:03:51.000Z", "lastUpdatedDate": "2023-12-19T00:03:51.000Z" }, "CloudWatchNetworkMonitorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchNetworkMonitorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-12-21T18:53:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PublishCw", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/NetworkMonitor" } } }, { "Sid": "DescribeAny", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "DeleteModifyEc2Resources", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:RevokeSecurityGroupEgress", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/ManagedByCloudWatchNetworkMonitor": "true" } } } ] } } }, "createdDate": "2023-12-21T18:53:19.000Z", "lastUpdatedDate": "2023-12-21T18:53:19.000Z" }, "AmazonOpenSearchDashboardsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchDashboardsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2023-12-22T19:38:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonOpenSearchDashboardsServiceRoleAllowedActions", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AOSD" } } } ] } } }, "createdDate": "2023-12-22T19:38:16.000Z", "lastUpdatedDate": "2023-12-22T19:38:16.000Z" }, "AWSArtifactReportsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSArtifactReportsReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-01-02T22:42:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ArtifactReportActions", "Effect": "Allow", "Action": [ "artifact:Get", "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-01-02T22:42:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ArtifactReportActions", "Effect": "Allow", "Action": [ "artifact:GetReport", "artifact:GetReportMetadata", "artifact:GetTermForReport", "artifact:ListReports" ], "Resource": "*" } ] } } }, "createdDate": "2024-01-02T22:42:58.000Z", "lastUpdatedDate": "2025-03-24T18:37:06.000Z" }, "AWSGrafanaWorkspacePermissionManagementV2": { "arn": "arn:aws:iam::aws:policy/AWSGrafanaWorkspacePermissionManagementV2", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-01-05T18:39:46.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSGrafanaPermissions", "Effect": "Allow", "Action": [ "grafana:DescribeWorkspace", "grafana:DescribeWorkspaceAuthentication", "grafana:UpdatePermissions", "grafana:ListPermissions", "grafana:ListWorkspaces" ], "Resource": "arn:aws:grafana:*:*:/workspaces*" }, { "Sid": "IAMIdentityCenterPermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:GetSharedSsoConfiguration", "sso:ListDirectoryAssociations", "sso:GetManagedApplicationInstance", "sso:ListProfiles", "sso:GetProfile", "sso:ListProfileAssociations", "sso-directory:DescribeUser", "sso-directory:DescribeGroup" ], "Resource": "*" } ] } } }, "createdDate": "2024-01-05T18:39:46.000Z", "lastUpdatedDate": "2024-01-05T18:39:46.000Z" }, "AmazonECSInfrastructureRolePolicyForVolumes": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonECSInfrastructureRolePolicyForVolumes", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-01-10T22:56:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateEBSManagedVolume", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "aws:RequestTag/AmazonECSManaged": "true" } } }, { "Sid": "TagOnCreateVolume", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "ec2:CreateAction": "CreateVolume", "aws:RequestTag/AmazonECSManaged": "true" } } }, { "Sid": "DescribeVolumesForLifecycle", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "ManageEBSVolumeLifecycle", "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true" } } }, { "Sid": "ManageVolumeAttachmentsForEC2", "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "DeleteEBSManagedVolume", "Effect": "Allow", "Action": "ec2:DeleteVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:ResourceTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true" } } } ] } }, "v2": { "createdDate": "2024-01-10T22:56:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateEBSManagedVolume", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "aws:RequestTag/AmazonECSManaged": "true" } } }, { "Sid": "CreateEBSManagedVolumeFromSnapshot", "Effect": "Allow", "Action": "ec2:CreateVolume", "Resource": "arn:aws:ec2:*:*:snapshot/*" }, { "Sid": "TagOnCreateVolume", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "ec2:CreateAction": "CreateVolume", "aws:RequestTag/AmazonECSManaged": "true" } } }, { "Sid": "DescribeVolumesForLifecycle", "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "ManageEBSVolumeLifecycle", "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true" } } }, { "Sid": "ManageVolumeAttachmentsForEC2", "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "DeleteEBSManagedVolume", "Effect": "Allow", "Action": "ec2:DeleteVolume", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "ArnLike": { "aws:ResourceTag/AmazonECSCreated": "arn:aws:ecs:*:*:task/*" }, "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true" } } } ] } } }, "createdDate": "2024-01-10T22:56:41.000Z", "lastUpdatedDate": "2024-10-10T18:56:53.000Z" }, "AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-01-19T20:08:36.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateSecret", "Effect": "Allow", "Action": "secretsmanager:CreateSecret", "Resource": "arn:aws:secretsmanager:*:*:secret:ecs-sc!*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": [ "arn:aws:ecs:*:*:service/*/*", "arn:aws:ecs:*:*:task-set/*/*" ] }, "StringEquals": { "aws:RequestTag/AmazonECSManaged": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagOnCreateSecret", "Effect": "Allow", "Action": "secretsmanager:TagResource", "Resource": "arn:aws:secretsmanager:*:*:secret:ecs-sc!*", "Condition": { "ArnLike": { "aws:RequestTag/AmazonECSCreated": [ "arn:aws:ecs:*:*:service/*/*", "arn:aws:ecs:*:*:task-set/*/*" ] }, "StringEquals": { "aws:RequestTag/AmazonECSManaged": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RotateTLSCertificateSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:DeleteSecret", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecretVersionStage" ], "Resource": "arn:aws:secretsmanager:*:*:secret:ecs-sc!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "ecs-sc", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagePrivateCertificateAuthority", "Effect": "Allow", "Action": [ "acm-pca:GetCertificate", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:DescribeCertificateAuthority" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true" } } }, { "Sid": "ManagePrivateCertificateAuthorityForIssuingEndEntityCertificate", "Effect": "Allow", "Action": [ "acm-pca:IssueCertificate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonECSManaged": "true", "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/EndEntityCertificate/V1" } } } ] } } }, "createdDate": "2024-01-19T20:08:36.000Z", "lastUpdatedDate": "2024-01-19T20:08:36.000Z" }, "AmazonSecurityLakeMetastoreManager": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonSecurityLakeMetastoreManager", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-01-23T15:26:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowWriteLambdaLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/AmazonSecurityLake*", "arn:aws:logs:*:*:/aws/lambda/AmazonSecurityLake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowGlueManage", "Effect": "Allow", "Action": [ "glue:CreatePartition", "glue:BatchCreatePartition", "glue:GetTable", "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToReadFromSqs", "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Resource": [ "arn:aws:sqs:*:*:AmazonSecurityLake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMetaDataReadWrite", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-security-data-lake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2024-01-23T15:26:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowWriteLambdaLogs", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/AmazonSecurityLake*", "arn:aws:logs:*:*:/aws/lambda/AmazonSecurityLake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowGlueManage", "Effect": "Allow", "Action": [ "glue:CreatePartition", "glue:BatchCreatePartition", "glue:GetTable", "glue:UpdateTable" ], "Resource": [ "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowToReadFromSqs", "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Resource": [ "arn:aws:sqs:*:*:AmazonSecurityLake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMetaDataReadWrite", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::aws-security-data-lake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMetaDataCleanup", "Effect": "Allow", "Action": [ "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::aws-security-data-lake*/metadata/*.avro", "arn:aws:s3:::aws-security-data-lake*/metadata/*.metadata.json" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-01-23T15:26:57.000Z", "lastUpdatedDate": "2024-04-01T20:04:24.000Z" }, "AmazonInspector2ManagedCisPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonInspector2ManagedCisPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-01-24T16:31:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PermissionsForCISScans", "Effect": "Allow", "Action": [ "inspector2:StartCisSession", "inspector2:StopCisSession", "inspector2:SendCisSessionTelemetry", "inspector2:SendCisSessionHealth" ], "Resource": "*" } ] } } }, "createdDate": "2024-01-24T16:31:43.000Z", "lastUpdatedDate": "2024-01-24T16:31:43.000Z" }, "AmazonLexReplicationPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonLexReplicationPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-01-31T23:29:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReplicationServicePolicyStatement1", "Effect": "Allow", "Action": [ "lex:BuildBotLocale", "lex:ListBotLocales", "lex:CreateBotAlias", "lex:UpdateBotAlias", "lex:DeleteBotAlias", "lex:DescribeBotAlias", "lex:CreateBotVersion", "lex:DeleteBotVersion", "lex:DescribeBotVersion", "lex:CreateExport", "lex:DescribeBot", "lex:UpdateExport", "lex:DescribeExport", "lex:DescribeBotLocale", "lex:DescribeIntent", "lex:ListIntents", "lex:DescribeSlotType", "lex:ListSlotTypes", "lex:DescribeSlot", "lex:ListSlots", "lex:DescribeCustomVocabulary", "lex:StartImport", "lex:DescribeImport", "lex:CreateBot", "lex:UpdateBot", "lex:DeleteBot", "lex:CreateBotLocale", "lex:UpdateBotLocale", "lex:DeleteBotLocale", "lex:CreateIntent", "lex:UpdateIntent", "lex:DeleteIntent", "lex:CreateSlotType", "lex:UpdateSlotType", "lex:DeleteSlotType", "lex:CreateSlot", "lex:UpdateSlot", "lex:DeleteSlot", "lex:CreateCustomVocabulary", "lex:UpdateCustomVocabulary", "lex:DeleteCustomVocabulary", "lex:DeleteBotChannel" ], "Resource": [ "arn:aws:lex:*:*:bot/*", "arn:aws:lex:*:*:bot-alias/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ReplicationServicePolicyStatement2", "Effect": "Allow", "Action": [ "lex:CreateUploadUrl", "lex:ListBots" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ReplicationServicePolicyStatement3", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "lexv2.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2024-01-31T23:29:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReplicationServicePolicyStatement1", "Effect": "Allow", "Action": [ "lex:BuildBotLocale", "lex:ListBotLocales", "lex:CreateBotAlias", "lex:UpdateBotAlias", "lex:DeleteBotAlias", "lex:DescribeBotAlias", "lex:CreateBotVersion", "lex:DeleteBotVersion", "lex:DescribeBotVersion", "lex:CreateExport", "lex:DescribeBot", "lex:UpdateExport", "lex:DescribeExport", "lex:DescribeBotLocale", "lex:DescribeIntent", "lex:ListIntents", "lex:DescribeSlotType", "lex:ListSlotTypes", "lex:DescribeSlot", "lex:ListSlots", "lex:DescribeCustomVocabulary", "lex:StartImport", "lex:DescribeImport", "lex:CreateBot", "lex:UpdateBot", "lex:DeleteBot", "lex:CreateBotLocale", "lex:UpdateBotLocale", "lex:DeleteBotLocale", "lex:CreateIntent", "lex:UpdateIntent", "lex:DeleteIntent", "lex:CreateSlotType", "lex:UpdateSlotType", "lex:DeleteSlotType", "lex:CreateSlot", "lex:UpdateSlot", "lex:DeleteSlot", "lex:CreateCustomVocabulary", "lex:UpdateCustomVocabulary", "lex:DeleteCustomVocabulary", "lex:DeleteBotChannel", "lex:DeleteResourcePolicy" ], "Resource": [ "arn:aws:lex:*:*:bot/*", "arn:aws:lex:*:*:bot-alias/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ReplicationServicePolicyStatement2", "Effect": "Allow", "Action": [ "lex:CreateUploadUrl", "lex:ListBots" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ReplicationServicePolicyStatement3", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "lexv2.amazonaws.com" } } } ] } } }, "createdDate": "2024-01-31T23:29:42.000Z", "lastUpdatedDate": "2024-03-08T17:11:32.000Z" }, "AmazonSageMakerCanvasBedrockAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasBedrockAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-02-02T18:37:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3CanvasAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*/Canvas", "arn:aws:s3:::sagemaker-*/Canvas/*" ] }, { "Sid": "S3BucketAccess", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ] } ] } } }, "createdDate": "2024-02-02T18:37:25.000Z", "lastUpdatedDate": "2024-02-02T18:37:25.000Z" }, "AWSServiceRoleForPrivateMarketplaceAdminPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForPrivateMarketplaceAdminPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-02-14T22:28:01.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PrivateMarketplaceCatalogDescribePermissions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Experience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/Audience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ProcurementPolicy/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/BrandingSettings/*" ] }, { "Sid": "PrivateMarketplaceCatalogDescribeChangeSetPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "PrivateMarketplaceCatalogListPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:ListChangeSets" ], "Resource": "*" }, { "Sid": "PrivateMarketplaceStartChangeSetPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Condition": { "StringEquals": { "catalog:ChangeType": [ "AssociateAudience", "DisassociateAudience" ] } }, "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Experience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ChangeSet/*" ] }, { "Sid": "PrivateMarketplaceOrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit", "organizations:ListDelegatedAdministrators", "organizations:ListChildren" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-02-14T22:28:01.000Z", "lastUpdatedDate": "2024-02-14T22:28:01.000Z" }, "AmazonRDSCustomInstanceProfileRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonRDSCustomInstanceProfileRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-02-27T17:42:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ssmAgentPermission1", "Effect": "Allow", "Action": [ "ssm:UpdateInstanceInformation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssmAgentPermission2", "Effect": "Allow", "Action": [ "ssm:GetManifest", "ssm:PutConfigurePackageResult" ], "Resource": "*" }, { "Sid": "ssmAgentPermission3", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssmAgentPermission4", "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:OpenControlChannel" ], "Resource": "*" }, { "Sid": "ssmAgentPermission5", "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Sid": "createEc2SnapshotPermission1", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createEc2SnapshotPermission2", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createEc2SnapshotPermission3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createTagForEc2SnapshotPermission", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateSnapshot", "CreateSnapshots" ] } } }, { "Sid": "rdsCustomS3ObjectPermission", "Effect": "Allow", "Action": [ "s3:putObject", "s3:getObject", "s3:getObjectVersion", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::do-not-delete-rds-custom-*/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "rdsCustomS3BucketPermission", "Effect": "Allow", "Action": [ "s3:ListBucketVersions", "s3:ListBucketMultipartUploads" ], "Resource": [ "arn:aws:s3:::do-not-delete-rds-custom-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "readSecretsFromCpPermission", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createSecretsOnDpPermission", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": "custom-oracle-rac" } } }, { "Sid": "publishCwMetricsPermission", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "rdscustom/rds-custom-sqlserver-agent", "RDSCustomForOracle/Agent" ] } } }, { "Sid": "putEventsToEventBusPermission", "Effect": "Allow", "Action": "events:PutEvents", "Resource": "arn:aws:events:*:*:event-bus/default" }, { "Sid": "cwlUploadPermission", "Effect": "Allow", "Action": [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:rds-custom-instance-*" }, { "Sid": "sendMessageToSqsQueuePermission", "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": "custom-sqlserver" } } }, { "Sid": "managePrivateIpOnEniPermission", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": "custom-oracle-rac" } } }, { "Sid": "kmsPermissionWithSecret", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" } } }, { "Sid": "kmsPermissionWithS3", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-rds-custom-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2024-02-27T17:42:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ssmAgentPermission1", "Effect": "Allow", "Action": [ "ssm:UpdateInstanceInformation" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "ssmAgentPermission2", "Effect": "Allow", "Action": [ "ssm:GetManifest", "ssm:PutConfigurePackageResult" ], "Resource": "*" }, { "Sid": "ssmAgentPermission3", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "ssmAgentPermission4", "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:OpenControlChannel" ], "Resource": "*" }, { "Sid": "ssmAgentPermission5", "Effect": "Allow", "Action": [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource": "*" }, { "Sid": "createEc2SnapshotPermission1", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createEc2SnapshotPermission2", "Effect": "Allow", "Action": [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*::snapshot/*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createEc2SnapshotPermission3", "Effect": "Allow", "Action": "ec2:CreateSnapshots", "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createTagForEc2SnapshotPermission", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction": [ "CreateSnapshot", "CreateSnapshots" ] } } }, { "Sid": "rdsCustomS3ObjectPermission", "Effect": "Allow", "Action": [ "s3:putObject", "s3:getObject", "s3:getObjectVersion", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::do-not-delete-rds-custom-*/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "rdsCustomS3BucketPermission", "Effect": "Allow", "Action": [ "s3:ListBucketVersions", "s3:ListBucketMultipartUploads" ], "Resource": [ "arn:aws:s3:::do-not-delete-rds-custom-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "readSecretsFromCpPermission", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid": "createSecretsOnDpPermission", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:RequestTag/AWSRDSCustom": "custom-oracle-rac" } } }, { "Sid": "publishCwMetricsPermission", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "rdscustom/rds-custom-sqlserver-agent", "RDSCustomForOracle/Agent" ] } } }, { "Sid": "putEventsToEventBusPermission", "Effect": "Allow", "Action": "events:PutEvents", "Resource": "arn:aws:events:*:*:event-bus/default" }, { "Sid": "cwlUploadPermission", "Effect": "Allow", "Action": [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:rds-custom-instance-*" }, { "Sid": "sendMessageToSqsQueuePermission", "Effect": "Allow", "Action": [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:do-not-delete-rds-custom-*" ], "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": "custom-sqlserver" } } }, { "Sid": "managePrivateIpOnEniPermission", "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringLike": { "aws:ResourceTag/AWSRDSCustom": "custom-oracle-rac" } } }, { "Sid": "kmsPermissionWithSecret", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "ArnLike": { "kms:EncryptionContext:SecretARN": [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*", "arn:aws:secretsmanager:*:*:secret:rds-custom!*" ] }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" } } }, { "Sid": "kmsPermissionWithS3", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-rds-custom-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } } ] } } }, "createdDate": "2024-02-27T17:42:02.000Z", "lastUpdatedDate": "2025-03-20T16:22:05.000Z" }, "AWSMarketplaceResaleAuthorizationServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceResaleAuthorizationServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-03-05T18:47:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowResaleAuthorizationShareActionsRAMCreate", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": [ "arn:aws:ram:*:*:*" ], "Condition": { "StringEquals": { "ram:RequestedResourceType": "aws-marketplace:Entity" }, "ArnLike": { "ram:ResourceArn": "arn:aws:aws-marketplace:*:*:AWSMarketplace/ResaleAuthorization/*" }, "Null": { "ram:Principal": "true" } } }, { "Sid": "AllowResaleAuthorizationShareActionsRAMAssociate", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare" ], "Resource": [ "arn:aws:ram:*:*:*" ], "Condition": { "Null": { "ram:Principal": "false" }, "StringEquals": { "ram:ResourceShareName": "AWSMarketplaceResaleAuthorization" } } }, { "Sid": "AllowResaleAuthorizationShareActionsRAMAccept", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": [ "arn:aws:ram:*:*:*" ], "Condition": { "StringEquals": { "ram:ResourceShareName": "AWSMarketplaceResaleAuthorization" } } }, { "Sid": "AllowResaleAuthorizationShareActionsRAMGet", "Effect": "Allow", "Action": [ "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": [ "arn:aws:ram:*:*:*" ] }, { "Sid": "AllowResaleAuthorizationShareActionsMarketplace", "Effect": "Allow", "Action": [ "aws-marketplace:PutResourcePolicy", "aws-marketplace:GetResourcePolicy" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/ResaleAuthorization/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "AllowResaleAuthorizationShareActionsMarketplaceDescribe", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace/ResaleAuthorization/*" } ] } } }, "createdDate": "2024-03-05T18:47:54.000Z", "lastUpdatedDate": "2024-03-05T18:47:54.000Z" }, "AmazonTimestreamInfluxDBServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonTimestreamInfluxDBServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-03-14T18:53:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeNetworkStatement", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "CreateEniInSubnetStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "CreateEniStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:RequestTag/AmazonTimestreamInfluxDBManaged": "false" } } }, { "Sid": "CreateTagWithEniStatement", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:RequestTag/AmazonTimestreamInfluxDBManaged": "false" }, "StringEquals": { "ec2:CreateAction": [ "CreateNetworkInterface" ] } } }, { "Sid": "ManageEniStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:ResourceTag/AmazonTimestreamInfluxDBManaged": "false" } } }, { "Sid": "PutCloudWatchMetricsStatement", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Timestream/InfluxDB", "AWS/Usage" ] } }, "Resource": [ "*" ] }, { "Sid": "ManageSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:READONLY-InfluxDB-auth-parameters-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-03-14T18:53:21.000Z", "lastUpdatedDate": "2024-03-14T18:53:21.000Z" }, "AmazonTimestreamInfluxDBFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonTimestreamInfluxDBFullAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2024-03-14T22:53:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TimestreamInfluxDBStatement", "Effect": "Allow", "Action": [ "timestream-influxdb:CreateDbParameterGroup", "timestream-influxdb:GetDbParameterGroup", "timestream-influxdb:ListDbParameterGroups", "timestream-influxdb:CreateDbInstance", "timestream-influxdb:DeleteDbInstance", "timestream-influxdb:GetDbInstance", "timestream-influxdb:ListDbInstances", "timestream-influxdb:TagResource", "timestream-influxdb:UntagResource", "timestream-influxdb:ListTagsForResource", "timestream-influxdb:UpdateDbInstance" ], "Resource": [ "arn:aws:timestream-influxdb:*:*:*" ] }, { "Sid": "ServiceLinkedRoleStatement", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/timestream-influxdb.amazonaws.com/AWSServiceRoleForTimestreamInfluxDB", "Condition": { "StringLike": { "iam:AWSServiceName": "timestream-influxdb.amazonaws.com" } } }, { "Sid": "NetworkValidationStatement", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups" ], "Resource": [ "*" ] }, { "Sid": "CreateEniInSubnetStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BucketValidationStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::*" ] } ] } }, "v2": { "createdDate": "2024-03-14T22:53:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TimestreamInfluxDBStatement", "Effect": "Allow", "Action": [ "timestream-influxdb:CreateDbParameterGroup", "timestream-influxdb:GetDbParameterGroup", "timestream-influxdb:ListDbParameterGroups", "timestream-influxdb:CreateDbInstance", "timestream-influxdb:DeleteDbInstance", "timestream-influxdb:GetDbInstance", "timestream-influxdb:ListDbInstances", "timestream-influxdb:TagResource", "timestream-influxdb:UntagResource", "timestream-influxdb:ListTagsForResource", "timestream-influxdb:UpdateDbInstance" ], "Resource": [ "arn:aws:timestream-influxdb:*:*:*" ] }, { "Sid": "ServiceLinkedRoleStatement", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/timestream-influxdb.amazonaws.com/AWSServiceRoleForTimestreamInfluxDB", "Condition": { "StringLike": { "iam:AWSServiceName": "timestream-influxdb.amazonaws.com" } } }, { "Sid": "NetworkValidationStatement", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "CreateEniInSubnetStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BucketValidationStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::*" ] } ] } }, "v3": { "createdDate": "2024-03-14T22:53:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TimestreamInfluxDBStatement", "Effect": "Allow", "Action": [ "timestream-influxdb:CreateDbParameterGroup", "timestream-influxdb:GetDbParameterGroup", "timestream-influxdb:ListDbParameterGroups", "timestream-influxdb:CreateDbInstance", "timestream-influxdb:DeleteDbInstance", "timestream-influxdb:GetDbInstance", "timestream-influxdb:ListDbInstances", "timestream-influxdb:TagResource", "timestream-influxdb:UntagResource", "timestream-influxdb:ListTagsForResource", "timestream-influxdb:UpdateDbInstance", "timestream-influxdb:CreateDbCluster", "timestream-influxdb:GetDbCluster", "timestream-influxdb:UpdateDbCluster", "timestream-influxdb:DeleteDbCluster", "timestream-influxdb:ListDbClusters", "timestream-influxdb:ListDbInstancesForCluster" ], "Resource": [ "arn:aws:timestream-influxdb:*:*:*" ] }, { "Sid": "ServiceLinkedRoleStatement", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/timestream-influxdb.amazonaws.com/AWSServiceRoleForTimestreamInfluxDB", "Condition": { "StringLike": { "iam:AWSServiceName": "timestream-influxdb.amazonaws.com" } } }, { "Sid": "NetworkValidationStatement", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables" ], "Resource": [ "*" ] }, { "Sid": "CreateEniInSubnetStatement", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BucketValidationStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::*" ] } ] } } }, "createdDate": "2024-03-14T22:53:22.000Z", "lastUpdatedDate": "2025-02-17T20:37:06.000Z" }, "AWSEC2VssSnapshotPolicy": { "arn": "arn:aws:iam::aws:policy/AWSEC2VssSnapshotPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-03-27T16:32:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceInfo", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:SourceInstanceARN": "*${ec2:InstanceId}" } } }, { "Sid": "CreateSnapshotsWithTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringLike": { "aws:RequestTag/AwsVssConfig": "*" } } }, { "Sid": "CreateSnapshotsAccessInstance", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:SourceInstanceARN": "*${ec2:InstanceId}" } } }, { "Sid": "CreateSnapshotsAccessVolume", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "CreateImageWithTag", "Effect": "Allow", "Action": [ "ec2:CreateImage" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringLike": { "aws:RequestTag/AwsVssConfig": "*" } } }, { "Sid": "CreateImageAccessInstance", "Effect": "Allow", "Action": [ "ec2:CreateImage" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ec2:SourceInstanceARN": "*${ec2:InstanceId}" } } }, { "Sid": "CreateTagsOnResourceCreation", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateImage", "CreateSnapshots" ] } } }, { "Sid": "CreateTagsAfterResourceCreation", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/AwsVssConfig": "*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AppConsistent", "Device" ] } } }, { "Sid": "DescribeImagesAndSnapshots", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-03-27T16:32:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeInstanceInfo", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ArnLike": { "ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/${ec2:InstanceId}" } } }, { "Sid": "CreateSnapshotsWithTag", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*" ], "Condition": { "StringLike": { "aws:RequestTag/AwsVssConfig": "*" } } }, { "Sid": "CreateSnapshotsAccessInstance", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ArnLike": { "ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/${ec2:InstanceId}" } } }, { "Sid": "CreateSnapshotsAccessVolume", "Effect": "Allow", "Action": [ "ec2:CreateSnapshots" ], "Resource": [ "arn:aws:ec2:*:*:volume/*" ] }, { "Sid": "CreateImageWithTag", "Effect": "Allow", "Action": [ "ec2:CreateImage" ], "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringLike": { "aws:RequestTag/AwsVssConfig": "*" } } }, { "Sid": "CreateImageAccessInstance", "Effect": "Allow", "Action": [ "ec2:CreateImage" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ArnLike": { "ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/${ec2:InstanceId}" } } }, { "Sid": "CreateTagsOnResourceCreation", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateImage", "CreateSnapshots" ] } } }, { "Sid": "CreateTagsAfterResourceCreation", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:image/*" ], "Condition": { "StringLike": { "ec2:ResourceTag/AwsVssConfig": "*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AppConsistent", "Device" ] } } }, { "Sid": "DescribeImagesAndSnapshots", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeSnapshots" ], "Resource": "*" } ] } } }, "createdDate": "2024-03-27T16:32:53.000Z", "lastUpdatedDate": "2024-11-20T17:44:08.000Z" }, "AWSQuickSightAssetBundleExportPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSightAssetBundleExportPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-03-27T21:31:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TagReadAccess", "Effect": "Allow", "Action": [ "quicksight:ListTagsForResource" ], "Resource": "arn:aws:quicksight:*:*:*/*" }, { "Sid": "DashboardReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeDashboard", "quicksight:DescribeDashboardPermissions" ], "Resource": "arn:aws:quicksight:*:*:dashboard/*" }, { "Sid": "AnalysisReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeAnalysis", "quicksight:DescribeAnalysisPermissions" ], "Resource": "arn:aws:quicksight:*:*:analysis/*" }, { "Sid": "DataSetReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeDataSet", "quicksight:DescribeDataSetRefreshProperties", "quicksight:ListRefreshSchedules", "quicksight:DescribeDataSetPermissions" ], "Resource": "arn:aws:quicksight:*:*:dataset/*" }, { "Sid": "DataSourceReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeDataSource", "quicksight:DescribeDataSourcePermissions" ], "Resource": "arn:aws:quicksight:*:*:datasource/*" }, { "Sid": "ThemeReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeTheme", "quicksight:DescribeThemePermissions" ], "Resource": "arn:aws:quicksight:*:*:theme/*" }, { "Sid": "VPCConnectionReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeVPCConnection", "quicksight:ListVPCConnections" ], "Resource": "arn:aws:quicksight:*:*:vpcConnection/*" }, { "Sid": "RefreshScheduleReadAccess", "Effect": "Allow", "Action": [ "quicksight:DescribeRefreshSchedule" ], "Resource": "arn:aws:quicksight:*:*:dataset/*/refresh-schedule/*" }, { "Sid": "AssetBundleExportOperations", "Effect": "Allow", "Action": [ "quicksight:DescribeAssetBundleExportJob", "quicksight:ListAssetBundleExportJobs", "quicksight:StartAssetBundleExportJob" ], "Resource": "arn:aws:quicksight:*:*:asset-bundle-export-job/*" } ] } } }, "createdDate": "2024-03-27T21:31:03.000Z", "lastUpdatedDate": "2024-03-27T21:31:03.000Z" }, "AWSQuickSightAssetBundleImportPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSightAssetBundleImportPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-03-27T21:40:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "TagWriteAccess", "Effect": "Allow", "Action": [ "quicksight:ListTagsForResource", "quicksight:TagResource", "quicksight:UntagResource" ], "Resource": "arn:aws:quicksight:*:*:*/*" }, { "Sid": "DashboardWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateDashboard", "quicksight:DeleteDashboard", "quicksight:DescribeDashboard", "quicksight:UpdateDashboard", "quicksight:UpdateDashboardPublishedVersion", "quicksight:DescribeDashboardPermissions", "quicksight:UpdateDashboardPermissions", "quicksight:UpdateDashboardLinks" ], "Resource": "arn:aws:quicksight:*:*:dashboard/*" }, { "Sid": "AnalysisWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateAnalysis", "quicksight:DeleteAnalysis", "quicksight:DescribeAnalysis", "quicksight:UpdateAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:UpdateAnalysisPermissions" ], "Resource": "arn:aws:quicksight:*:*:analysis/*" }, { "Sid": "DataSetWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateDataSet", "quicksight:DeleteDataSet", "quicksight:DescribeDataSet", "quicksight:PassDataSet", "quicksight:UpdateDataSet", "quicksight:DeleteDataSetRefreshProperties", "quicksight:DescribeDataSetRefreshProperties", "quicksight:PutDataSetRefreshProperties", "quicksight:UpdateDataSetPermissions", "quicksight:DescribeDataSetPermissions", "quicksight:ListRefreshSchedules" ], "Resource": "arn:aws:quicksight:*:*:dataset/*" }, { "Sid": "DataSourceWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateDataSource", "quicksight:DescribeDataSource", "quicksight:DeleteDataSource", "quicksight:PassDataSource", "quicksight:UpdateDataSource", "quicksight:UpdateDataSourcePermissions", "quicksight:DescribeDataSourcePermissions" ], "Resource": "arn:aws:quicksight:*:*:datasource/*" }, { "Sid": "ThemeWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateTheme", "quicksight:DeleteTheme", "quicksight:DescribeTheme", "quicksight:UpdateTheme", "quicksight:DescribeThemePermissions", "quicksight:UpdateThemePermissions" ], "Resource": "arn:aws:quicksight:*:*:theme/*" }, { "Sid": "RefreshScheduleWriteAccess", "Effect": "Allow", "Action": [ "quicksight:CreateRefreshSchedule", "quicksight:DescribeRefreshSchedule", "quicksight:DeleteRefreshSchedule", "quicksight:UpdateRefreshSchedule" ], "Resource": "arn:aws:quicksight:*:*:dataset/*/refresh-schedule/*" }, { "Sid": "VPCConnectionWriteAccess", "Effect": "Allow", "Action": [ "quicksight:ListVPCConnections", "quicksight:CreateVPCConnection", "quicksight:DescribeVPCConnection", "quicksight:DeleteVPCConnection", "quicksight:UpdateVPCConnection" ], "Resource": "arn:aws:quicksight:*:*:vpcConnection/*" }, { "Sid": "AssetBundleImportOperations", "Effect": "Allow", "Action": [ "quicksight:DescribeAssetBundleImportJob", "quicksight:ListAssetBundleImportJobs", "quicksight:StartAssetBundleImportJob" ], "Resource": "arn:aws:quicksight:*:*:asset-bundle-import-job/*" } ] } } }, "createdDate": "2024-03-27T21:40:34.000Z", "lastUpdatedDate": "2024-03-27T21:40:34.000Z" }, "AWSDeadlineCloud-UserAccessFarms": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-UserAccessFarms", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-01T16:54:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFarm", "deadline:AssociateMemberToFleet", "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue", "deadline:CreateBudget", "deadline:DeleteBudget", "deadline:DisassociateMemberFromFarm", "deadline:DisassociateMemberFromFleet", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue", "deadline:GetBudget", "deadline:GetSessionsStatisticsAggregation", "deadline:ListBudgets", "deadline:StartSessionsStatisticsAggregation", "deadline:UpdateBudget" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFarm", "deadline:AssociateMemberToFleet", "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromFarm", "deadline:DisassociateMemberFromFleet", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListFarmMembers", "deadline:ListFleetMembers", "deadline:ListJobMembers", "deadline:ListQueueMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "OwnerManagerContributorPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForUser", "deadline:CreateJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeFleetRoleForRead", "deadline:AssumeQueueRoleForRead", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListFarms", "deadline:ListFleets", "deadline:ListJobs", "deadline:ListQueues" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } }, "v2": { "createdDate": "2024-04-01T16:54:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFarm", "deadline:AssociateMemberToFleet", "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue", "deadline:CreateBudget", "deadline:DeleteBudget", "deadline:DisassociateMemberFromFarm", "deadline:DisassociateMemberFromFleet", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue", "deadline:GetBudget", "deadline:GetSessionsStatisticsAggregation", "deadline:ListBudgets", "deadline:StartSessionsStatisticsAggregation", "deadline:UpdateBudget" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFarm", "deadline:AssociateMemberToFleet", "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromFarm", "deadline:DisassociateMemberFromFleet", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListFarmMembers", "deadline:ListFleetMembers", "deadline:ListJobMembers", "deadline:ListQueueMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "OwnerManagerContributorPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForUser", "deadline:CreateJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeFleetRoleForRead", "deadline:AssumeQueueRoleForRead", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetJob", "deadline:GetJobTemplate", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:GetWorker", "deadline:ListJobParameterDefinitions", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListSessionsForWorker", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfiles", "deadline:ListStorageProfilesForQueue", "deadline:ListTasks", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks", "deadline:SearchWorkers" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FarmMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListFarms", "deadline:ListFleets", "deadline:ListJobs", "deadline:ListQueues" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } } }, "createdDate": "2024-04-01T16:54:00.000Z", "lastUpdatedDate": "2024-10-07T17:57:52.000Z" }, "AWSDeadlineCloud-UserAccessFleets": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-UserAccessFleets", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-01T17:01:50.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFleet", "deadline:DisassociateMemberFromFleet" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FleetMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToFleet" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FleetMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromFleet" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FleetMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListFleetMembers" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FleetMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeFleetRoleForRead", "deadline:GetFleet", "deadline:GetQueueFleetAssociation", "deadline:GetWorker", "deadline:ListQueueFleetAssociations", "deadline:ListSessionsForWorker", "deadline:ListWorkers", "deadline:SearchWorkers" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:FleetMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListFleets" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } } }, "createdDate": "2024-04-01T17:01:50.000Z", "lastUpdatedDate": "2024-04-01T17:01:50.000Z" }, "AWSDeadlineCloud-UserAccessJobs": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-UserAccessJobs", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-01T17:05:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:DisassociateMemberFromJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListJobMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:GetJob", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetTask", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListTasks", "deadline:SearchSteps", "deadline:SearchTasks" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListJobs" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } }, "v2": { "createdDate": "2024-04-01T17:05:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:DisassociateMemberFromJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListJobMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:GetJob", "deadline:GetJobTemplate", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetTask", "deadline:ListJobParameterDefinitions", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListTasks", "deadline:SearchSteps", "deadline:SearchTasks" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:JobMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListJobs" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } } }, "createdDate": "2024-04-01T17:05:38.000Z", "lastUpdatedDate": "2024-10-07T18:24:52.000Z" }, "AWSDeadlineCloud-UserAccessQueues": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-UserAccessQueues", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-01T17:10:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListJobMembers", "deadline:ListQueueMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "OwnerManagerContributorPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForUser", "deadline:CreateJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForRead", "deadline:GetJob", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfilesForQueue", "deadline:ListTasks", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListJobs", "deadline:ListQueues" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } }, "v2": { "createdDate": "2024-04-01T17:10:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AdditionalPermissions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMembershipsForMember", "deadline:GetApplicationVersion", "ec2:DescribeInstanceTypes", "identitystore:ListUsers" ], "Resource": [ "*" ] }, { "Sid": "OwnerLevelPermissions", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue", "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER" ] } } }, { "Sid": "ManagerLevelMemberAssociation", "Effect": "Allow", "Action": [ "deadline:AssociateMemberToJob", "deadline:AssociateMemberToQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ], "deadline:MembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ManagerLevelMemberDisassociation", "Effect": "Allow", "Action": [ "deadline:DisassociateMemberFromJob", "deadline:DisassociateMemberFromQueue" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "MANAGER" ] }, "StringEquals": { "deadline:AssociatedMembershipLevel": [ "MANAGER", "CONTRIBUTOR", "VIEWER", "" ] } } }, { "Sid": "OwnerManagerPermissions", "Effect": "Allow", "Action": [ "deadline:ListJobMembers", "deadline:ListQueueMembers", "deadline:UpdateJob", "deadline:UpdateSession", "deadline:UpdateStep", "deadline:UpdateTask" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER" ] } } }, { "Sid": "OwnerManagerContributorPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForUser", "deadline:CreateJob" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR" ] } } }, { "Sid": "AllLevelsPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeQueueRoleForRead", "deadline:GetJob", "deadline:GetJobTemplate", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", "deadline:GetSessionAction", "deadline:GetStep", "deadline:GetStorageProfileForQueue", "deadline:GetTask", "deadline:ListJobParameterDefinitions", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", "deadline:ListSessionActions", "deadline:ListSessions", "deadline:ListStepConsumers", "deadline:ListStepDependencies", "deadline:ListSteps", "deadline:ListStorageProfilesForQueue", "deadline:ListTasks", "deadline:SearchJobs", "deadline:SearchSteps", "deadline:SearchTasks" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "deadline:QueueMembershipLevels": [ "OWNER", "MANAGER", "CONTRIBUTOR", "VIEWER" ] } } }, { "Sid": "ListBasedOnMembership", "Effect": "Allow", "Action": [ "deadline:ListJobs", "deadline:ListQueues" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "deadline:RequesterPrincipalId": "${deadline:PrincipalId}" } } } ] } } }, "createdDate": "2024-04-01T17:10:03.000Z", "lastUpdatedDate": "2024-10-07T18:25:13.000Z" }, "AWSDeadlineCloud-FleetWorker": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-FleetWorker", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-01T17:21:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "RunTasksPermissions", "Effect": "Allow", "Action": [ "deadline:AssumeFleetRoleForWorker", "deadline:UpdateWorker", "deadline:UpdateWorkerSchedule", "deadline:BatchGetJobEntity", "deadline:AssumeQueueRoleForWorker" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2024-04-01T17:21:47.000Z", "lastUpdatedDate": "2024-04-01T17:21:47.000Z" }, "AWSDeadlineCloud-WorkerHost": { "arn": "arn:aws:iam::aws:policy/AWSDeadlineCloud-WorkerHost", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-01T17:28:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "JoinFleetPermissions", "Effect": "Allow", "Action": [ "deadline:CreateWorker", "deadline:AssumeFleetRoleForWorker" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } } ] } } }, "createdDate": "2024-04-01T17:28:28.000Z", "lastUpdatedDate": "2024-04-01T17:28:28.000Z" }, "SplitCostAllocationDataServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/SplitCostAllocationDataServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-16T16:05:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsOrganizationsAccess", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListParents" ], "Resource": "*" }, { "Sid": "AmazonManagedServiceForPrometheusAccess", "Effect": "Allow", "Action": [ "aps:ListWorkspaces", "aps:QueryMetrics" ], "Resource": "*" } ] } } }, "createdDate": "2024-04-16T16:05:16.000Z", "lastUpdatedDate": "2024-04-16T16:05:16.000Z" }, "AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary", "latestVersionId": "v5", "versionsCount": 5, "versions": { "v1": { "createdDate": "2024-04-23T23:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowSageMakerProfileManagement", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile", "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:*/${sagemaker:DomainId}/*" }, { "Sid": "AllowLakeFormation", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "AllowAddTagsForAppAndSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateApp", "CreateSpace" ] } } }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeApp", "sagemaker:DescribeDomain", "sagemaker:DescribeSpace", "sagemaker:DescribeUserProfile", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListSpaces", "sagemaker:ListUserProfiles" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "sqlworkbench:*", "datazone:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "groundtruthlabeling:*", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage" ], "Resource": [ "arn:aws:ecr:*:*:repository/*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "bedrock.amazonaws.com", "states.amazonaws.com", "lakeformation.amazonaws.com", "events.amazonaws.com", "sagemaker.amazonaws.com", "forecast.amazonaws.com" ] } } }, { "Sid": "CrossAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTags", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:domain/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:ListJobs", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDataQualityRuleset" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueActionsWithEnvironmentTag", "Effect": "Allow", "Action": [ "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:ListSchemas", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:GetConnection", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowRedshiftClusterActions", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowCreateClusterUser", "Effect": "Allow", "Action": [ "redshift:CreateClusterUser" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*" ] }, { "Sid": "AllowCreateSecretActions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*", "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AllowEventBridgeRule", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "AllowEMR", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters" ], "Resource": "*" }, { "Sid": "AllowSSOAction", "Effect": "Allow", "Action": [ "sso:CreateApplicationAssignment" ], "Resource": "*" }, { "Sid": "DenyNotAction", "Effect": "Deny", "NotAction": [ "sagemaker:*", "sagemaker-geospatial:*", "sqlworkbench:*", "datazone:*", "forecast:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudformation:ListStackResources", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "codecommit:GitPull", "codecommit:GitPush", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters", "events:PutRule", "events:DescribeRule", "events:PutTargets", "events:TagResource", "events:ListTagsForResource", "fsx:DescribeFileSystems", "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGet*", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:Get*", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:List*", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "groundtruthlabeling:*", "iam:CreateServiceLinkedRole", "iam:ListRoles", "iam:PassRole", "kms:DescribeKey", "kms:ListAliases", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "lakeformation:GetDataAccess", "lambda:ListFunctions", "lambda:InvokeFunction", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "rds:DescribeDBInstances", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "s3:GetBucketAcl", "s3:PutObjectAcl", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors", "s3:DeleteObjectVersion", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:TagResource", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:ProvisionProduct", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "sns:ListTopics", "sns:Subscribe", "sns:CreateTopic", "sns:Publish", "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine", "tag:GetResources", "sso:CreateApplicationAssignment" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-04-23T23:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowSageMakerProfileManagement", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile", "sagemaker:UpdateUserProfile", "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:*/*" }, { "Sid": "AllowLakeFormation", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "AllowAddTagsForAppAndSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateApp", "CreateSpace" ] } } }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeApp", "sagemaker:DescribeDomain", "sagemaker:DescribeSpace", "sagemaker:DescribeUserProfile", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListSpaces", "sagemaker:ListUserProfiles" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "sqlworkbench:*", "datazone:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "groundtruthlabeling:*", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowRAMInvitation", "Effect": "Allow", "Action": "ram:AcceptResourceShareInvitation", "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "dzd_*" } } }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:TagResource", "ecr:UntagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker*", "arn:aws:ecr:*:*:repository/datazone*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "bedrock.amazonaws.com", "states.amazonaws.com", "lakeformation.amazonaws.com", "events.amazonaws.com", "sagemaker.amazonaws.com", "forecast.amazonaws.com" ] } } }, { "Sid": "CrossAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTags", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:domain/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:ListJobs", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDataQualityRuleset", "glue:GetDatabases", "glue:GetTables" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueActionsWithEnvironmentTag", "Effect": "Allow", "Action": [ "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:ListSchemas", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:GetConnection", "glue:GetDatabase", "glue:GetTable", "glue:GetPartition", "glue:GetPartitions", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowGlueDefaultAccess", "Effect": "Allow", "Action": [ "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:RunStatement" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:connection/dz-sm-*", "arn:aws:glue:*:*:session/*" ] }, { "Sid": "AllowRedshiftClusterActions", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowCreateClusterUser", "Effect": "Allow", "Action": [ "redshift:CreateClusterUser" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*" ] }, { "Sid": "AllowCreateSecretActions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*", "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AllowEventBridgeRule", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "AllowEMR", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters" ], "Resource": "*" }, { "Sid": "AllowSSOAction", "Effect": "Allow", "Action": [ "sso:CreateApplicationAssignment" ], "Resource": "*" }, { "Sid": "DenyNotAction", "Effect": "Deny", "NotAction": [ "sagemaker:*", "sagemaker-geospatial:*", "sqlworkbench:*", "datazone:*", "forecast:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudformation:ListStackResources", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "codecommit:GitPull", "codecommit:GitPush", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:StartImageScan", "ecr:TagResource", "ecr:UntagResource", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters", "events:PutRule", "events:DescribeRule", "events:PutTargets", "events:TagResource", "events:ListTagsForResource", "fsx:DescribeFileSystems", "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGet*", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:Get*", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:List*", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreateDatabase", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "groundtruthlabeling:*", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:DescribeKey", "kms:ListAliases", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant", "lakeformation:GetDataAccess", "lambda:ListFunctions", "lambda:InvokeFunction", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "ram:AcceptResourceShareInvitation", "rds:DescribeDBInstances", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:GetBucketAcl", "s3:PutObjectAcl", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors", "s3:DeleteObjectVersion", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy", "secretsmanager:TagResource", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:ProvisionProduct", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "sns:ListTopics", "sns:Subscribe", "sns:CreateTopic", "sns:Publish", "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine", "tag:GetResources", "sso:CreateApplicationAssignment" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2024-04-23T23:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowSageMakerProfileManagement", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile", "sagemaker:UpdateUserProfile", "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:*/*" }, { "Sid": "AllowLakeFormation", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "AllowAddTagsForAppAndSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateApp", "CreateSpace" ] } } }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeApp", "sagemaker:DescribeDomain", "sagemaker:DescribeSpace", "sagemaker:DescribeUserProfile", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListSpaces", "sagemaker:ListUserProfiles" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "sqlworkbench:*", "datazone:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "groundtruthlabeling:*", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowRAMInvitation", "Effect": "Allow", "Action": "ram:AcceptResourceShareInvitation", "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "dzd_*" } } }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:TagResource", "ecr:UntagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker*", "arn:aws:ecr:*:*:repository/datazone*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "bedrock.amazonaws.com", "states.amazonaws.com", "lakeformation.amazonaws.com", "events.amazonaws.com", "sagemaker.amazonaws.com", "forecast.amazonaws.com" ] } } }, { "Sid": "CrossAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTags", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:domain/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:ListJobs", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:GetPartition", "glue:GetPartitions", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:GetDatabases", "glue:GetTables", "glue:GetTable", "glue:SearchTables", "glue:NotifyEvent", "glue:ListSchemas", "glue:BatchGetJobs", "glue:GetConnection", "glue:GetDatabase" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueActionsWithEnvironmentTag", "Effect": "Allow", "Action": [ "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:ListSchemas", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:GetConnection", "glue:GetDatabase", "glue:GetTable", "glue:GetPartition", "glue:GetPartitions", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowGlueDefaultAccess", "Effect": "Allow", "Action": [ "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:RunStatement" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:connection/dz-sm-*", "arn:aws:glue:*:*:session/*" ] }, { "Sid": "AllowRedshiftClusterActions", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowCreateClusterUser", "Effect": "Allow", "Action": [ "redshift:CreateClusterUser" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*" ] }, { "Sid": "AllowCreateSecretActions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*", "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AllowEventBridgeRule", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "AllowEMR", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters" ], "Resource": "*" }, { "Sid": "AllowSSOAction", "Effect": "Allow", "Action": [ "sso:CreateApplicationAssignment" ], "Resource": "*" }, { "Sid": "DenyNotAction", "Effect": "Deny", "NotAction": [ "sagemaker:*", "sagemaker-geospatial:*", "sqlworkbench:*", "datazone:*", "forecast:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudformation:ListStackResources", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "codecommit:GitPull", "codecommit:GitPush", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:StartImageScan", "ecr:TagResource", "ecr:UntagResource", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters", "events:PutRule", "events:DescribeRule", "events:PutTargets", "events:TagResource", "events:ListTagsForResource", "fsx:DescribeFileSystems", "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGet*", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:Get*", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:List*", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreateDatabase", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "groundtruthlabeling:*", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:DescribeKey", "kms:ListAliases", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant", "lakeformation:GetDataAccess", "lambda:ListFunctions", "lambda:InvokeFunction", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "ram:AcceptResourceShareInvitation", "rds:DescribeDBInstances", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:GetBucketAcl", "s3:PutObjectAcl", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors", "s3:DeleteObjectVersion", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy", "secretsmanager:TagResource", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:ProvisionProduct", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "sns:ListTopics", "sns:Subscribe", "sns:CreateTopic", "sns:Publish", "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine", "tag:GetResources", "sso:CreateApplicationAssignment" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2024-04-23T23:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowSageMakerProfileManagement", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile", "sagemaker:UpdateUserProfile", "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:*/*" }, { "Sid": "AllowLakeFormation", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "AllowAddTagsForAppAndSpace", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateApp", "CreateSpace" ] } } }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeApp", "sagemaker:DescribeDomain", "sagemaker:DescribeSpace", "sagemaker:DescribeUserProfile", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListSpaces", "sagemaker:ListUserProfiles" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "sqlworkbench:*", "datazone:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "groundtruthlabeling:*", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowRAMInvitation", "Effect": "Allow", "Action": "ram:AcceptResourceShareInvitation", "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "dzd_*" } } }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:TagResource", "ecr:UntagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker*", "arn:aws:ecr:*:*:repository/datazone*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "bedrock.amazonaws.com", "states.amazonaws.com", "lakeformation.amazonaws.com", "events.amazonaws.com", "sagemaker.amazonaws.com", "forecast.amazonaws.com" ] } } }, { "Sid": "CrossAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTags", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:domain/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:ListJobs", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:GetPartition", "glue:GetPartitions", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:GetDatabases", "glue:GetTables", "glue:GetTable", "glue:SearchTables", "glue:NotifyEvent", "glue:ListSchemas", "glue:BatchGetJobs", "glue:GetConnection", "glue:GetDatabase" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueActionsWithEnvironmentTag", "Effect": "Allow", "Action": [ "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:ListSchemas", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:GetConnection", "glue:GetDatabase", "glue:GetTable", "glue:GetPartition", "glue:GetPartitions", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowGlueDefaultAccess", "Effect": "Allow", "Action": [ "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:RunStatement" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:connection/dz-sm-*", "arn:aws:glue:*:*:session/*" ] }, { "Sid": "AllowRedshiftClusterActions", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowCreateClusterUser", "Effect": "Allow", "Action": [ "redshift:CreateClusterUser" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*" ] }, { "Sid": "AllowCreateSecretActions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*", "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AllowEventBridgeRule", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "AllowEMR", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters" ], "Resource": "*" }, { "Sid": "AllowSSOAction", "Effect": "Allow", "Action": [ "sso:CreateApplicationAssignment", "sso:AssociateProfile" ], "Resource": "*" }, { "Sid": "DenyNotAction", "Effect": "Deny", "NotAction": [ "sagemaker:*", "sagemaker-geospatial:*", "sqlworkbench:*", "datazone:*", "forecast:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudformation:ListStackResources", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "codecommit:GitPull", "codecommit:GitPush", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:StartImageScan", "ecr:TagResource", "ecr:UntagResource", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters", "events:PutRule", "events:DescribeRule", "events:PutTargets", "events:TagResource", "events:ListTagsForResource", "fsx:DescribeFileSystems", "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGet*", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:Get*", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:List*", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreateDatabase", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "groundtruthlabeling:*", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:DescribeKey", "kms:ListAliases", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant", "lakeformation:GetDataAccess", "lambda:ListFunctions", "lambda:InvokeFunction", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "ram:AcceptResourceShareInvitation", "rds:DescribeDBInstances", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:GetBucketAcl", "s3:PutObjectAcl", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors", "s3:DeleteObjectVersion", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy", "secretsmanager:TagResource", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:ProvisionProduct", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "sns:ListTopics", "sns:Subscribe", "sns:CreateTopic", "sns:Publish", "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine", "tag:GetResources", "sso:CreateApplicationAssignment", "sso:AssociateProfile" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2024-04-23T23:01:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllNonAdminSageMakerActions", "Effect": "Allow", "Action": [ "sagemaker:*", "sagemaker-geospatial:*" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Sid": "AllowSageMakerProfileManagement", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DescribeUserProfile", "sagemaker:UpdateUserProfile", "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:*/*" }, { "Sid": "AllowLakeFormation", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "AllowAddTagsForDomainResources", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:user-profile/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateApp", "CreateSpace", "CreateUserProfile" ] } } }, { "Sid": "AllowStudioActions", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:DescribeApp", "sagemaker:DescribeDomain", "sagemaker:DescribeSpace", "sagemaker:DescribeUserProfile", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListSpaces", "sagemaker:ListUserProfiles" ], "Resource": "*" }, { "Sid": "AllowAppActionsForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "AllowAppActionsForSharedSpaces", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "StringEquals": { "sagemaker:SpaceSharingType": [ "Shared" ] } } }, { "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "Null": { "sagemaker:OwnerUserProfileArn": "true" } } }, { "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private", "Shared" ] } } }, { "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", "Condition": { "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" }, "StringEquals": { "sagemaker:SpaceSharingType": [ "Private" ] } } }, { "Sid": "AllowFlowDefinitionActions", "Effect": "Allow", "Action": "sagemaker:*", "Resource": [ "arn:aws:sagemaker:*:*:flow-definition/*" ], "Condition": { "StringEqualsIfExists": { "sagemaker:WorkteamType": [ "private-crowd", "vendor-crowd" ] } } }, { "Sid": "AllowAWSServiceActions", "Effect": "Allow", "Action": [ "sqlworkbench:*", "datazone:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:StartImageScan", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "fsx:DescribeFileSystems", "groundtruthlabeling:*", "iam:GetRole", "iam:ListRoles", "kms:DescribeKey", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "secretsmanager:ListSecrets", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "sns:ListTopics", "tag:GetResources" ], "Resource": "*" }, { "Sid": "AllowRAMInvitation", "Effect": "Allow", "Action": "ram:AcceptResourceShareInvitation", "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": "dzd_*" } } }, { "Sid": "AllowECRActions", "Effect": "Allow", "Action": [ "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:TagResource", "ecr:UntagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker*", "arn:aws:ecr:*:*:repository/datazone*" ] }, { "Sid": "AllowCodeCommitActions", "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] }, { "Sid": "AllowCodeBuildActions", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker*", "arn:aws:codebuild:*:*:build/*" ], "Effect": "Allow" }, { "Sid": "AllowStepFunctionsActions", "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:statemachine:*sagemaker*", "arn:aws:states:*:*:execution:*sagemaker*:*" ], "Effect": "Allow" }, { "Sid": "AllowSecretManagerActions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" ] }, { "Sid": "AllowServiceCatalogProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:ProvisionProduct" ], "Resource": "*" }, { "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct", "Effect": "Allow", "Action": [ "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct" ], "Resource": "*", "Condition": { "StringEquals": { "servicecatalog:userLevel": "self" } } }, { "Sid": "AllowS3ObjectActions", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "s3:GetBucketAcl", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" } } }, { "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AllowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::Sagemaker-DataZone*", "arn:aws:s3:::DataZone-Sagemaker*", "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "ReadSageMakerJumpstartArtifacts", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*", "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*", "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*", "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*", "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*", "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*" ] }, { "Sid": "AllowLambdaInvokeFunction", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*", "arn:aws:lambda:*:*:function:*LabelingFunction*" ] }, { "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling", "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "AllowSNSActions", "Effect": "Allow", "Action": [ "sns:Subscribe", "sns:CreateTopic", "sns:Publish" ], "Resource": [ "arn:aws:sns:*:*:*SageMaker*", "arn:aws:sns:*:*:*Sagemaker*", "arn:aws:sns:*:*:*sagemaker*" ] }, { "Sid": "AllowPassRoleForSageMakerRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "bedrock.amazonaws.com", "states.amazonaws.com", "lakeformation.amazonaws.com", "events.amazonaws.com", "sagemaker.amazonaws.com", "forecast.amazonaws.com" ] } } }, { "Sid": "CrossAccountKmsOperations", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KmsOperationsWithResourceTag", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowAthenaActions", "Effect": "Allow", "Action": [ "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueCreateDatabase", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowRedshiftGetClusterCredentials", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowListTags", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:domain/*" ] }, { "Sid": "AllowCloudformationListStackResources", "Effect": "Allow", "Action": [ "cloudformation:ListStackResources" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AllowGlueActions", "Effect": "Allow", "Action": [ "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:ListJobs", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchGetWorkflows", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:GetPartition", "glue:GetPartitions", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:GetDatabases", "glue:GetTables", "glue:GetTable", "glue:SearchTables", "glue:NotifyEvent", "glue:ListSchemas", "glue:BatchGetJobs", "glue:GetConnection", "glue:GetDatabase" ], "Resource": [ "*" ] }, { "Sid": "AllowGlueActionsWithEnvironmentTag", "Effect": "Allow", "Action": [ "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:ListSchemas", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGetJobs", "glue:BatchGetWorkflows", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:GetConnection", "glue:GetDatabase", "glue:GetTable", "glue:GetPartition", "glue:GetPartitions", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AllowGlueDefaultAccess", "Effect": "Allow", "Action": [ "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:RunStatement" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:connection/dz-sm-*", "arn:aws:glue:*:*:session/*" ] }, { "Sid": "AllowRedshiftClusterActions", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters" ], "Resource": [ "arn:aws:redshift:*:*:cluster:*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid": "AllowCreateClusterUser", "Effect": "Allow", "Action": [ "redshift:CreateClusterUser" ], "Resource": [ "arn:aws:redshift:*:*:dbuser:*" ] }, { "Sid": "AllowCreateSecretActions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*", "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] } } }, { "Sid": "ForecastOperations", "Effect": "Allow", "Action": [ "forecast:CreateExplainabilityExport", "forecast:CreateExplainability", "forecast:CreateForecastEndpoint", "forecast:CreateAutoPredictor", "forecast:CreateDatasetImportJob", "forecast:CreateDatasetGroup", "forecast:CreateDataset", "forecast:CreateForecast", "forecast:CreateForecastExportJob", "forecast:CreatePredictorBacktestExportJob", "forecast:CreatePredictor", "forecast:DescribeExplainabilityExport", "forecast:DescribeExplainability", "forecast:DescribeAutoPredictor", "forecast:DescribeForecastEndpoint", "forecast:DescribeDatasetImportJob", "forecast:DescribeDataset", "forecast:DescribeForecast", "forecast:DescribeForecastExportJob", "forecast:DescribePredictorBacktestExportJob", "forecast:GetAccuracyMetrics", "forecast:InvokeForecastEndpoint", "forecast:GetRecentForecastContext", "forecast:DescribePredictor", "forecast:TagResource", "forecast:DeleteResourceTree" ], "Resource": [ "arn:aws:forecast:*:*:*Canvas*" ] }, { "Sid": "RDSOperation", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }, { "Sid": "AllowEventBridgeRule", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeOperations", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutTargets" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeTagBasedOperations", "Effect": "Allow", "Action": [ "events:TagResource" ], "Resource": "arn:aws:events:*:*:rule/*", "Condition": { "StringEquals": { "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true" } } }, { "Sid": "EventBridgeListTagOperation", "Effect": "Allow", "Action": "events:ListTagsForResource", "Resource": "*" }, { "Sid": "AllowEMR", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters" ], "Resource": "*" }, { "Sid": "AllowSSOAction", "Effect": "Allow", "Action": [ "sso:CreateApplicationAssignment", "sso:AssociateProfile" ], "Resource": "*" }, { "Sid": "DenyNotAction", "Effect": "Deny", "NotAction": [ "sagemaker:*", "sagemaker-geospatial:*", "sqlworkbench:*", "datazone:*", "forecast:*", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "aws-marketplace:ViewSubscriptions", "cloudformation:GetTemplateSummary", "cloudformation:ListStackResources", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codecommit:BatchGetRepositories", "codecommit:CreateRepository", "codecommit:GetRepository", "codecommit:List*", "codecommit:GitPull", "codecommit:GitPush", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CreateRepository", "ecr:Describe*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:StartImageScan", "ecr:TagResource", "ecr:UntagResource", "elastic-inference:Connect", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListClusters", "events:PutRule", "events:DescribeRule", "events:PutTargets", "events:TagResource", "events:ListTagsForResource", "fsx:DescribeFileSystems", "glue:SearchTables", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:BatchGet*", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:Get*", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:List*", "glue:CreateSession", "glue:RunStatement", "glue:BatchCreatePartition", "glue:CreateDatabase", "glue:CreatePartitionIndex", "glue:CreateTable", "glue:BatchUpdatePartition", "glue:BatchDeletePartition", "glue:UpdateTable", "glue:DeleteTableVersion", "glue:DeleteTable", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:BatchDeleteTable", "glue:CreatePartition", "glue:DeletePartition", "glue:UpdatePartition", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "groundtruthlabeling:*", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:DescribeKey", "kms:ListAliases", "kms:Decrypt", "kms:ListKeys", "kms:Encrypt", "kms:GenerateDataKey", "kms:RetireGrant", "lakeformation:GetDataAccess", "lambda:ListFunctions", "lambda:InvokeFunction", "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:UpdateLogDelivery", "ram:AcceptResourceShareInvitation", "rds:DescribeDBInstances", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift:GetClusterCredentialsWithIAM", "redshift:DescribeClusters", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListSchemas", "redshift-data:ListTables", "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetCredentials", "s3:GetBucketAcl", "s3:PutObjectAcl", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketCors", "s3:PutBucketCors", "s3:DeleteObjectVersion", "s3:PutObjectRetention", "s3:ReplicateObject", "s3:RestoreObject", "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy", "secretsmanager:TagResource", "servicecatalog:Describe*", "servicecatalog:List*", "servicecatalog:ScanProvisionedProducts", "servicecatalog:SearchProducts", "servicecatalog:SearchProvisionedProducts", "servicecatalog:ProvisionProduct", "servicecatalog:TerminateProvisionedProduct", "servicecatalog:UpdateProvisionedProduct", "sns:ListTopics", "sns:Subscribe", "sns:CreateTopic", "sns:Publish", "states:DescribeExecution", "states:GetExecutionHistory", "states:StartExecution", "states:StopExecution", "states:UpdateStateMachine", "tag:GetResources", "sso:CreateApplicationAssignment", "sso:AssociateProfile" ], "Resource": "*" } ] } } }, "createdDate": "2024-04-23T23:01:14.000Z", "lastUpdatedDate": "2024-11-21T23:06:06.000Z" }, "AmazonDataZoneSageMakerProvisioningRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerProvisioningRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-23T23:32:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateSageMakerStudio", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneEnvironment": "false", "aws:RequestTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "DeleteSageMakerStudio", "Effect": "Allow", "Action": [ "sagemaker:DeleteDomain" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneEnvironmentSageMakerDescribePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "sagemaker.amazonaws.com" ], "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary" } } }, { "Sid": "AmazonDataZonePermissionsToManageEnvironmentRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToCreateSageMakerServiceRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentParameterValidation", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "sagemaker:ListDomains" ], "Resource": "*" }, { "Sid": "AmazonDataZoneEnvironmentKMSKeyValidation", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneEnvironmentGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/dz-sm-athena-glue-connection-*", "arn:aws:glue:*:*:connection/dz-sm-redshift-cluster-connection-*", "arn:aws:glue:*:*:connection/dz-sm-redshift-serverless-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2024-04-23T23:32:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateSageMakerStudio", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneEnvironment": "false", "aws:RequestTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "DeleteSageMakerStudio", "Effect": "Allow", "Action": [ "sagemaker:DeleteDomain" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "Null": { "aws:TagKeys": "false", "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneEnvironmentSageMakerDescribePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "IamPassRolePermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "sagemaker.amazonaws.com" ], "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary" } } }, { "Sid": "AmazonDataZonePermissionsToManageEnvironmentRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:GetRolePolicy", "iam:DeleteRole" ], "Resource": [ "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZonePermissionsToCreateSageMakerServiceRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "AmazonDataZoneEnvironmentParameterValidation", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "sagemaker:ListDomains" ], "Resource": "*" }, { "Sid": "AmazonDataZoneEnvironmentKMSKeyValidation", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonDataZoneEnvironmentGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection", "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/dz-sm-athena-glue-connection-*", "arn:aws:glue:*:*:connection/dz-sm-redshift-cluster-connection-*", "arn:aws:glue:*:*:connection/dz-sm-redshift-serverless-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-04-23T23:32:28.000Z", "lastUpdatedDate": "2025-01-09T20:52:06.000Z" }, "AmazonDataZoneSageMakerManageAccessRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerManageAccessRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-23T23:34:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerReadPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeFeatureGroup", "sagemaker:ListModelPackages", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeAlgorithm", "sagemaker:ListTags", "sagemaker:DescribeDomain", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:Search" ], "Resource": "*" }, { "Sid": "AmazonSageMakerTaggingPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:shared-with:*" ] } } }, { "Sid": "AmazonSageMakerModelPackageGroupPolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutModelPackageGroupPolicy", "sagemaker:DeleteModelPackageGroupPolicy" ], "Resource": [ "arn:*:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "AmazonSageMakerRAMPermission", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "AmazonSageMakerRAMResourcePolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutResourcePolicy", "sagemaker:GetResourcePolicy", "sagemaker:DeleteResourcePolicy" ], "Resource": [ "arn:*:sagemaker:*:*:feature-group/*" ] }, { "Sid": "AmazonSageMakerRAMTagResourceSharePermission", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMDeleteResourceSharePermission", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:ResourceTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMCreateResourceSharePermission", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "sagemaker:*" ] }, "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerS3BucketPolicyPermission", "Effect": "Allow", "Action": [ "s3:DeleteBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AmazonSageMakerS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AmazonSageMakerECRPermission", "Effect": "Allow", "Action": [ "ecr:GetRepositoryPolicy", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonSageMakerKMSReadPermission", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] } } }, { "Sid": "AmazonSageMakerKMSGrantPermission", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "Decrypt" ] } } } ] } }, "v2": { "createdDate": "2024-04-23T23:34:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerReadPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeFeatureGroup", "sagemaker:ListModelPackages", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeAlgorithm", "sagemaker:ListTags", "sagemaker:DescribeDomain", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:Search" ], "Resource": "*" }, { "Sid": "AmazonSageMakerTaggingPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:shared-with:*" ] } } }, { "Sid": "AmazonSageMakerModelPackageGroupPolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutModelPackageGroupPolicy", "sagemaker:DeleteModelPackageGroupPolicy" ], "Resource": [ "arn:*:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "AmazonSageMakerRAMPermission", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "AmazonSageMakerRAMResourcePolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutResourcePolicy", "sagemaker:GetResourcePolicy", "sagemaker:DeleteResourcePolicy" ], "Resource": [ "arn:*:sagemaker:*:*:feature-group/*" ] }, { "Sid": "AmazonSageMakerRAMTagResourceSharePermission", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMDeleteResourceSharePermission", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:ResourceTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMCreateResourceSharePermission", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "sagemaker:*" ] }, "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerS3BucketPolicyPermission", "Effect": "Allow", "Action": [ "s3:DeleteBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid": "AmazonSageMakerS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid": "AmazonSageMakerECRPermission", "Effect": "Allow", "Action": [ "ecr:GetRepositoryPolicy", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonSageMakerKMSReadPermission", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] } } }, { "Sid": "AmazonSageMakerKMSGrantPermission", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "Decrypt" ] } } } ] } } }, "createdDate": "2024-04-23T23:34:52.000Z", "lastUpdatedDate": "2024-11-21T20:21:06.000Z" }, "AWSServiceRoleForAmazonQDeveloper": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonQDeveloper", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-25T07:40:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "sid1", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/Q" ] } } } ] } } }, "createdDate": "2024-04-25T07:40:41.000Z", "lastUpdatedDate": "2024-04-25T07:40:41.000Z" }, "AWSServiceRoleForUserSubscriptions": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForUserSubscriptions", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-25T16:14:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SubscriptionManagementPolicy", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "organizations:DescribeOrganization", "sso:DescribeApplication", "sso:DescribeInstance", "sso:ListInstances" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2024-04-25T16:14:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SubscriptionManagementPolicy", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:IsMemberInGroups", "identitystore:ListGroupMemberships", "organizations:DescribeOrganization", "sso:DescribeApplication", "sso:DescribeInstance", "sso:ListInstances", "sso-directory:DescribeUser" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-04-25T16:14:06.000Z", "lastUpdatedDate": "2025-02-21T17:37:06.000Z" }, "QBusinessServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/QBusinessServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-04-29T16:05:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "QBusinessPutMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/QBusiness" } } }, { "Sid": "QBusinessCreateLogGroupPermission", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/qbusiness/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "QBusinessDescribeLogGroupsPermission", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "QBusinessLogStreamPermission", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/qbusiness/*:log-stream:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-04-29T16:05:44.000Z", "lastUpdatedDate": "2024-04-29T16:05:44.000Z" }, "AmazonRoute53ProfilesReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53ProfilesReadOnlyAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-30T18:29:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ProfilesReadOnlyAccess", "Effect": "Allow", "Action": [ "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:GetFirewallConfig", "route53resolver:GetResolverConfig", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverQueryLogConfig" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2024-04-30T18:29:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ProfilesReadOnlyAccess", "Effect": "Allow", "Action": [ "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfilePolicy", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:GetFirewallConfig", "route53resolver:GetResolverConfig", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverQueryLogConfig" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-04-30T18:29:25.000Z", "lastUpdatedDate": "2024-08-27T18:59:57.000Z" }, "AmazonRoute53ProfilesFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonRoute53ProfilesFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-04-30T18:30:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ProfilesFullAccess", "Effect": "Allow", "Action": [ "route53profiles:AssociateProfile", "route53profiles:AssociateResourceToProfile", "route53profiles:CreateProfile", "route53profiles:DeleteProfile", "route53profiles:DisassociateProfile", "route53profiles:DisassociateResourceFromProfile", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53profiles:TagResource", "route53profiles:UntagResource", "route53profiles:UpdateProfileResourceAssociation", "route53resolver:GetFirewallConfig", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetResolverConfig", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "ec2:DescribeVpcs", "route53:GetHostedZone" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2024-04-30T18:30:29.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonRoute53ProfilesFullAccess", "Effect": "Allow", "Action": [ "route53profiles:AssociateProfile", "route53profiles:AssociateResourceToProfile", "route53profiles:CreateProfile", "route53profiles:DeleteProfile", "route53profiles:DisassociateProfile", "route53profiles:DisassociateResourceFromProfile", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfilePolicy", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53profiles:PutProfilePolicy", "route53profiles:TagResource", "route53profiles:UntagResource", "route53profiles:UpdateProfileResourceAssociation", "route53resolver:GetFirewallConfig", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetResolverConfig", "route53resolver:GetResolverDnssecConfig", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverRule", "ec2:DescribeVpcs", "route53:GetHostedZone" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-04-30T18:30:29.000Z", "lastUpdatedDate": "2024-08-27T19:18:18.000Z" }, "AmazonOpenSearchDirectQueryGlueCreateAccess": { "arn": "arn:aws:iam::aws:policy/AmazonOpenSearchDirectQueryGlueCreateAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-05-06T12:24:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonOpenSearchDirectQueryGlueCreateAccess", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:BatchCreatePartition" ], "Resource": "*" } ] } } }, "createdDate": "2024-05-06T12:24:38.000Z", "lastUpdatedDate": "2024-05-06T12:24:38.000Z" }, "EC2FastLaunchFullAccess": { "arn": "arn:aws:iam::aws:policy/EC2FastLaunchFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-05-13T22:45:26.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2FastLaunch", "Effect": "Allow", "Action": [ "ec2:EnableFastLaunch", "ec2:DisableFastLaunch", "ec2:DescribeFastLaunchImages" ], "Resource": "*" }, { "Sid": "EC2ReadOnly", "Effect": "Allow", "Action": [ "ec2:DescribeImages", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "EC2LaunchInstance", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:launch-template/*" ] }, { "Sid": "EC2LaunchInstanceWithVolAndInstance", "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "EC2 Fast Launch" } } }, { "Sid": "EC2Tags", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ], "Condition": { "StringEquals": { "ec2:CreateAction": "RunInstances" } } }, { "Sid": "IAMSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fastlaunch.amazonaws.com/AWSServiceRoleForEC2FastLaunch", "Condition": { "StringLike": { "iam:AWSServiceName": "ec2fastlaunch.amazonaws.com" } } }, { "Sid": "IAMSLRPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:instance-profile/*", "arn:aws:iam::*:role/*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } } ] } } }, "createdDate": "2024-05-13T22:45:26.000Z", "lastUpdatedDate": "2024-05-13T22:45:26.000Z" }, "AmazonSESServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonSESServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-05-21T16:02:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPutMetricDataToSESCloudWatchNamespaces", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": [ "AWS/SES", "AWS/SES/MailManager", "AWS/SES/Addons" ] } } } ] } } }, "createdDate": "2024-05-21T16:02:20.000Z", "lastUpdatedDate": "2024-05-21T16:02:20.000Z" }, "CloudWatchApplicationSignalsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchApplicationSignalsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-06T22:48:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchApplicationSignalsReadOnlyAccessPermissions", "Effect": "Allow", "Action": [ "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:ListServiceLevelObjectives", "application-signals:ListServiceDependencies", "application-signals:ListServiceDependents", "application-signals:ListServiceOperations", "application-signals:ListServices", "application-signals:ListTagsForResource" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsGetRolePermissions", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" }, { "Sid": "CloudWatchApplicationSignalsLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*" }, { "Sid": "CloudWatchApplicationSignalsLogsPermissions", "Effect": "Allow", "Action": [ "logs:StopQuery", "logs:GetQueryResults" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsAlarmsReadPermissions", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsMetricsReadPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsSyntheticsReadPermissions", "Effect": "Allow", "Action": [ "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:GetCanaryRuns" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsRumReadPermissions", "Effect": "Allow", "Action": [ "rum:BatchGetRumMetricDefinitions", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsXrayReadPermissions", "Effect": "Allow", "Action": [ "xray:GetTraceSummaries" ], "Resource": "*" } ] } } }, "createdDate": "2024-06-06T22:48:30.000Z", "lastUpdatedDate": "2024-06-06T22:48:30.000Z" }, "CloudWatchApplicationSignalsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchApplicationSignalsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-06T22:50:16.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchApplicationSignalsFullAccessPermissions", "Effect": "Allow", "Action": "application-signals:*", "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsAlarmsPermissions", "Effect": "Allow", "Action": "cloudwatch:DescribeAlarms", "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:StartQuery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*" }, { "Sid": "CloudWatchApplicationSignalsLogsPermissions", "Effect": "Allow", "Action": [ "logs:StopQuery", "logs:GetQueryResults" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsSyntheticsPermissions", "Effect": "Allow", "Action": [ "synthetics:DescribeCanaries", "synthetics:DescribeCanariesLastRun", "synthetics:GetCanaryRuns" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsRumPermissions", "Effect": "Allow", "Action": [ "rum:BatchCreateRumMetricDefinitions", "rum:BatchDeleteRumMetricDefinitions", "rum:BatchGetRumMetricDefinitions", "rum:GetAppMonitor", "rum:GetAppMonitorData", "rum:ListAppMonitors", "rum:PutRumMetricsDestination", "rum:UpdateRumMetricDefinition" ], "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsXrayPermissions", "Effect": "Allow", "Action": "xray:GetTraceSummaries", "Resource": "*" }, { "Sid": "CloudWatchApplicationSignalsPutMetricAlarmPermissions", "Effect": "Allow", "Action": "cloudwatch:PutMetricAlarm", "Resource": [ "arn:aws:cloudwatch:*:*:alarm:SLO-AttainmentGoalAlarm-*", "arn:aws:cloudwatch:*:*:alarm:SLO-WarningAlarm-*", "arn:aws:cloudwatch:*:*:alarm:SLI-HealthAlarm-*" ] }, { "Sid": "CloudWatchApplicationSignalsCreateServiceLinkedRolePermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals", "Condition": { "StringLike": { "iam:AWSServiceName": "application-signals.cloudwatch.amazonaws.com" } } }, { "Sid": "CloudWatchApplicationSignalsGetRolePermissions", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" }, { "Sid": "CloudWatchApplicationSignalsSnsWritePermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:cloudwatch-application-signals-*" }, { "Sid": "CloudWatchApplicationSignalsSnsReadPermissions", "Effect": "Allow", "Action": "sns:ListTopics", "Resource": "*" } ] } } }, "createdDate": "2024-06-06T22:50:16.000Z", "lastUpdatedDate": "2024-06-06T22:50:16.000Z" }, "AWSBCMDataExportsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSBCMDataExportsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-10T17:40:19.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CostOptimizationRecommendationAccess", "Effect": "Allow", "Action": [ "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations" ], "Resource": "*" } ] } } }, "createdDate": "2024-06-10T17:40:19.000Z", "lastUpdatedDate": "2024-06-10T17:40:19.000Z" }, "OpensearchIngestionSelfManagedVpcePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/OpensearchIngestionSelfManagedVpcePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-10T19:59:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DescribeEc2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcEndpoints" ], "Resource": "*" }, { "Sid": "CwPermissionsForOsiNamespace", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/OSIS" } } } ] } } }, "createdDate": "2024-06-10T19:59:40.000Z", "lastUpdatedDate": "2024-06-10T19:59:40.000Z" }, "AWSApplicationAutoscalingWorkSpacesPoolPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingWorkSpacesPoolPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-17T18:39:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WorkSpacesActionsOnAllPools", "Effect": "Allow", "Action": [ "workspaces:DescribeWorkspacesPools", "workspaces:UpdateWorkspacesPool" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchActionsOnAllAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchActionsOnTargetTrackingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:TargetTracking*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-06-17T18:39:07.000Z", "lastUpdatedDate": "2024-06-17T18:39:07.000Z" }, "ECRTemplateServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/ECRTemplateServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-19T23:11:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateRepositoryWithTemplate", "Effect": "Allow", "Action": [ "ecr:CreateRepository" ], "Resource": "*" } ] } } }, "createdDate": "2024-06-19T23:11:37.000Z", "lastUpdatedDate": "2024-06-19T23:11:37.000Z" }, "AmazonWorkSpacesSecureBrowserReadOnly": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesSecureBrowserReadOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-24T20:01:09.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WorkSpacesSecureBrowser", "Effect": "Allow", "Action": [ "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetTrustStoreCertificate", "workspaces-web:GetUserSettings", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetIpAccessSettings", "workspaces-web:ListBrowserSettings", "workspaces-web:ListIdentityProviders", "workspaces-web:ListNetworkSettings", "workspaces-web:ListPortals", "workspaces-web:ListTagsForResource", "workspaces-web:ListTrustStoreCertificates", "workspaces-web:ListTrustStores", "workspaces-web:ListUserSettings", "workspaces-web:ListUserAccessLoggingSettings", "workspaces-web:ListIpAccessSettings" ], "Resource": "arn:aws:workspaces-web:*:*:*" }, { "Sid": "Dependencies", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "kinesis:ListStreams" ], "Resource": "*" } ] } } }, "createdDate": "2024-06-24T20:01:09.000Z", "lastUpdatedDate": "2024-06-24T20:01:09.000Z" }, "SSMQuickSetupRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/SSMQuickSetupRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2024-06-25T15:20:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SSMResourceDataSyncPermissions", "Effect": "Allow", "Action": [ "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "SSMResourceDataSyncGetOpsSummaryPermissions", "Effect": "Allow", "Action": [ "ssm:GetOpsSummary" ], "Resource": "arn:aws:ssm:*:*:resource-data-sync/AWS-QuickSetup-*" }, { "Sid": "SSMAssociationsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:ListAssociations", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Sid": "QuickSetupSSMDocumentsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetupType-*", "arn:aws:ssm:*:*:document/*-AWSQuickSetupType-*" ] }, { "Sid": "OrganizationReadOnlyPermissions", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" }, { "Sid": "QuickSetupStackSetReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*" ] }, { "Sid": "QuickSetupStackSetDeletePermissions", "Effect": "Allow", "Action": [ "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:type/resource/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2024-06-25T15:20:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SSMResourceDataSyncPermissions", "Effect": "Allow", "Action": [ "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "SSMResourceDataSyncGetOpsSummaryPermissions", "Effect": "Allow", "Action": [ "ssm:GetOpsSummary" ], "Resource": "arn:aws:ssm:*:*:resource-data-sync/AWS-QuickSetup-*" }, { "Sid": "SSMAssociationsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:ListAssociations", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Sid": "QuickSetupSSMDocumentsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetupType-*", "arn:aws:ssm:*:*:document/*-AWSQuickSetupType-*" ] }, { "Sid": "OrganizationReadOnlyPermissions", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" }, { "Sid": "QuickSetupStackSetReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset/SSMQuickSetup*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-SSMQuickSetup*" ] }, { "Sid": "QuickSetupStackSetDeletePermissions", "Effect": "Allow", "Action": [ "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset/SSMQuickSetup*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-SSMQuickSetup*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset-target/SSMQuickSetup*", "arn:aws:cloudformation:*:*:type/resource/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v3": { "createdDate": "2024-06-25T15:20:04.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SSMResourceDataSyncPermissions", "Effect": "Allow", "Action": [ "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "SSMResourceDataSyncGetOpsSummaryPermissions", "Effect": "Allow", "Action": [ "ssm:GetOpsSummary" ], "Resource": "arn:aws:ssm:*:*:resource-data-sync/AWS-QuickSetup-*" }, { "Sid": "SSMResourceDataSyncManagePermissions", "Effect": "Allow", "Action": [ "ssm:DeleteResourceDataSync" ], "Resource": "arn:aws:ssm:*:*:resource-data-sync/AWS-QuickSetup-*", "Condition": { "StringEquals": { "ssm:SyncType": "SyncFromSource" } } }, { "Sid": "SSMAssociationsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:ListAssociations", "ssm:DescribeAssociationExecutions" ], "Resource": "*" }, { "Sid": "QuickSetupSSMDocumentsReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetupType-*", "arn:aws:ssm:*:*:document/*-AWSQuickSetupType-*" ] }, { "Sid": "OrganizationReadOnlyPermissions", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListAccountsForParent", "organizations:ListOrganizationalUnitsForParent", "organizations:ListDelegatedServicesForAccount" ], "Resource": "*" }, { "Sid": "QuickSetupStackSetReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults", "cloudformation:GetTemplate" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset/SSMQuickSetup*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-SSMQuickSetup*" ] }, { "Sid": "QuickSetupStackSetDeletePermissions", "Effect": "Allow", "Action": [ "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset/SSMQuickSetup*", "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/StackSet-SSMQuickSetup*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stackset-target/SSMQuickSetup*", "arn:aws:cloudformation:*:*:type/resource/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "QuickSetupCfnStacksDescribePermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-06-25T15:20:04.000Z", "lastUpdatedDate": "2024-11-18T13:06:59.000Z" }, "AWSQuickSetupPatchPolicyBaselineAccess": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:38:00.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "QuickSetupPatchingBaselineOverridesS3SameAccountReadOnlyAccess", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::aws-quicksetup-patchpolicy-*", "Condition": { "StringEquals": { "aws:PrincipalAccount": [ "${aws:ResourceAccount}" ] } } }, { "Sid": "QuickSetupPatchingBaselineOverridesS3OrganizationReadOnlyAccess", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::aws-quicksetup-patchpolicy-*", "Condition": { "StringEquals": { "aws:PrincipalOrgID": [ "${aws:ResourceOrgID}" ] } } } ] } } }, "createdDate": "2024-06-26T09:38:00.000Z", "lastUpdatedDate": "2024-06-26T09:38:00.000Z" }, "AWSSystemsManagerEnableConfigRecordingExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSSystemsManagerEnableConfigRecordingExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:40:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3BucketCreatePermissions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::aws-quick-setup-config-recording-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SNSTopicsListPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "DefaultSNSTopicCreatePermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic" ], "Resource": "arn:aws:sns:*:*:ConfigRecording-Default-Topic" }, { "Sid": "ConfigureAndStartConfigurationRecorderPermissions", "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "config:DescribeDeliveryChannels", "config:PutConfigurationRecorder", "config:PutDeliveryChannel", "config:StartConfigurationRecorder" ], "Resource": "*" }, { "Sid": "GetAndPassConfigSLRPermissions", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig", "arn:aws:iam::*:role/AWSServiceRoleForConfig" ] }, { "Sid": "CreateConfigSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "config.amazonaws.com" } } } ] } } }, "createdDate": "2024-06-26T09:40:20.000Z", "lastUpdatedDate": "2024-06-26T09:40:20.000Z" }, "AWSSystemsManagerEnableExplorerExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSSystemsManagerEnableExplorerExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:42:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateSystemsManagerSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "SSMExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:42:47.000Z", "lastUpdatedDate": "2024-06-26T09:42:47.000Z" }, "AWSQuickSetupDevOpsGuruPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupDevOpsGuruPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:44:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateSystemsManagerSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "CreateDevOpsGuruSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/devops-guru.amazonaws.com/AWSServiceRoleForDevOpsGuru" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "devops-guru.amazonaws.com" } } }, { "Sid": "CloudformationReadOnlyPermissions", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks" ], "Resource": "*" }, { "Sid": "DevOpsGuruNotificationChannelPermissions", "Effect": "Allow", "Action": [ "devops-guru:AddNotificationChannel" ], "Resource": [ "arn:aws:sns:*:*:DevOpsGuru-Default-Topic", "arn:aws:devops-guru:*:*:/channels" ] }, { "Sid": "DevOpsGuruConfigurationPermissions", "Effect": "Allow", "Action": [ "devops-guru:UpdateResourceCollection", "devops-guru:UpdateServiceIntegration" ], "Resource": "*" }, { "Sid": "SNSReadOnlyPermissions", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "DevOpsGuruDefaultSNSTopicConfigurationPermissions", "Effect": "Allow", "Action": [ "sns:AddPermission", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:RemovePermission" ], "Resource": "arn:aws:sns:*:*:DevOpsGuru-Default-Topic" }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "SSMExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:44:42.000Z", "lastUpdatedDate": "2024-06-26T09:44:42.000Z" }, "AWSQuickSetupPatchPolicyPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:46:54.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PatchingAutomationRoleGetPermissions", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ] }, { "Sid": "PatchingAutomationRolePassPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "DefaultInstanceRolePermissions", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Condition": { "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceRolePassPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } }, { "Sid": "PoliciesAttachPermissions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess" ] }, "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "CreateSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "InstanceRoleAddPermissions", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile" ], "Resource": [ "*" ] }, { "Sid": "ManagedInstanceRoleUpdatePermissions", "Effect": "Allow", "Action": [ "ssm:UpdateManagedInstanceRole" ], "Resource": "*" }, { "Sid": "IAMReadOnlyPermissions", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "InstanceProfileCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "InstanceProfileAssociationPermissions", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": "*", "Condition": { "Null": { "ec2:InstanceProfile": "true" }, "ArnLike": { "ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "InstanceProfileDisassociationPermissions", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile" ], "Resource": "*", "Condition": { "ArnLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "SSMAssociationsPermissions", "Effect": "Allow", "Action": [ "ssm:DescribeAssociationExecutions", "ssm:UpdateAssociation", "ssm:DescribeAssociation" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "BaselineS3Permissions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:Put*", "s3:Get*", "s3:List*", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:DeleteBucket" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } }, "Resource": "arn:aws:s3:::aws-quicksetup-patchpolicy-*" }, { "Sid": "PatchingFunctionsPermissions", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:baseline-overrides-*", "arn:aws:lambda:*:*:function:delete-name-tags-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "LoggingPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*", "arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*" ] }, { "Sid": "SSMTaggingPermissions", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource" ], "Resource": "arn:aws:ssm:*:*:managed-instance/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "QSConfigName-*" } } }, { "Sid": "EC2TaggingPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "QSConfigName-*" } } }, { "Sid": "RoleTaggingPermissions", "Effect": "Allow", "Action": [ "iam:TagRole", "iam:UntagRole" ], "Resource": "*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": "QSConfigId-*" } } }, { "Sid": "PatchingReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:GetPatchBaseline", "ssm:GetInventory", "ssm:DescribeInstanceInformation", "ssm:DescribeAssociation", "ssm:GetAutomationExecution", "ssm:ListTagsForResource", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "PatchingAutomationsStartPermissions", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*", "arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*", "arn:aws:ssm:*:*:automation-definition/QuickSetup-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*" ] }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "ExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:46:54.000Z", "lastUpdatedDate": "2024-06-26T09:46:54.000Z" }, "AWSQuickSetupSSMHostMgmtPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMHostMgmtPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:48:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "HostManagementAutomationRoleGetPermissions", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" ] }, { "Sid": "HostManagementAutomationRolePassPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "DefaultInstanceRoleManagePermissions", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" } } }, { "Sid": "DefaultInstanceRolePassToEC2Permissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "DefaultInstanceRolePassToSSMPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "InstanceManagementPoliciesAttachPermissions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AmazonSSMPatchAssociation" ] }, "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" } }, "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "CreateSystemsManagerSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "DefaultInstanceRoleAddPermissions", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile" ], "Resource": [ "*" ] }, { "Sid": "IAMReadOnlyPermissions", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "DefaultInstanceProfileCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceProfileAssociationPermissions", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": "*", "Condition": { "Null": { "ec2:InstanceProfile": "true" }, "ArnLike": { "ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "DefaultInstanceProfileDisassociationPermissions", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile" ], "Resource": "*", "Condition": { "ArnLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "ConfigurationAutomationsStartPermissions", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-HostMgmt-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-CreateAndAttachIAMToInstance-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-UpdateExistingInstanceProfile-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-InstallAndManageCloudWatchDocument-*", "arn:aws:ssm:*:*:automation-definition/UpdateCloudWatchDocument-*", "arn:aws:ssm:*:*:automation-definition/AWSEC2-UpdateLaunchAgent-*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*", "arn:aws:ssm:*:*:automation-definition/AWS-GatherSoftwareInventory*", "arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaselineAssociation*", "arn:aws:ssm:*:*:automation-definition/AWS-UpdateSSMAgent*" ] }, { "Sid": "ReadOnlyPermissionsForEnablingHostManagementBySSM", "Effect": "Allow", "Action": [ "ssm:ListTagsForResource", "ssm:GetAutomationExecution", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "SSMExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:48:42.000Z", "lastUpdatedDate": "2024-06-26T09:48:42.000Z" }, "AWSQuickSetupDistributorPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupDistributorPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:50:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DistributorAutomationRoleGetPermissions", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-RoleForDistributor-*" ] }, { "Sid": "DistributorAutomationRolePassPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-RoleForDistributor-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "DefaultInstanceRoleManagePermissions", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Condition": { "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-RoleForDistributor-*" } }, "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceRolePassToEC2Permissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "DefaultInstanceRolePassToSSMPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "InstanceManagementPoliciesAttachPermissions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" ] }, "StringLike": { "aws:PrincipalTag/QuickSetupManagerID": "*" }, "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-RoleForDistributor-*" } }, "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "CreateSystemsManagerSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "DefaultInstanceRoleAddPermissions", "Effect": "Allow", "Action": [ "iam:AddRoleToInstanceProfile" ], "Resource": [ "*" ] }, { "Sid": "IAMReadOnlyPermissions", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource": [ "*" ] }, { "Sid": "DefaultInstanceProfileCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceProfileAssociationPermissions", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": "*", "Condition": { "Null": { "ec2:InstanceProfile": "true" }, "ArnLike": { "ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "DefaultInstanceProfileDisassociationPermissions", "Effect": "Allow", "Action": [ "ec2:DisassociateIamInstanceProfile" ], "Resource": "*", "Condition": { "ArnLike": { "ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "ConfigurationAutomationsStartPermissions", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-Distributor-*", "arn:aws:ssm:*:*:automation-definition/UpdateCloudWatchDocument-Distributor-*", "arn:aws:ssm:*:*:automation-definition/AWS-ConfigureAWSPackage*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*" ] }, { "Sid": "ReadOnlyPermissionsForEnablingHostManagementBySSM", "Effect": "Allow", "Action": [ "ssm:ListTagsForResource", "ssm:GetAutomationExecution", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "SSMExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:50:21.000Z", "lastUpdatedDate": "2024-06-26T09:50:21.000Z" }, "AWSQuickSetupCFGCPacksPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupCFGCPacksPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:52:11.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConfigurationRoleGetPermissions", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-CFGCPacks*" ] }, { "Sid": "ConfigurationRolePassToSSMPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-CFGCPacks*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "PutCPackPermissions", "Effect": "Allow", "Action": [ "config:PutConformancePack" ], "Resource": [ "arn:aws:config:*:*:conformance-pack/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "DescribeCPacksPermissions", "Effect": "Allow", "Action": [ "config:DescribeConformancePackStatus" ], "Resource": "*" }, { "Sid": "ConformancePacksSLRCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Sid": "SystemsManagerSLRCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "EnableExplorerReadOnlyPermissions", "Effect": "Allow", "Action": [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "ServiceSettingsForExplorerUpdatePermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:52:11.000Z", "lastUpdatedDate": "2024-06-26T09:52:11.000Z" }, "AWSQuickSetupSchedulerPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSchedulerPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:53:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConfigurationAutomationRoleGetPermissions", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-Scheduler-*" ] }, { "Sid": "ConfigurationAutomationRolePassPermissions", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-Scheduler-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "SystemsManagerCalendarReadOnlyPermissions", "Effect": "Allow", "Action": [ "ssm:GetCalendarState" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-ChangeCalendar-*" ] }, { "Sid": "EC2ReadOnlyPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeRegions", "ec2:DescribeTags", "tag:GetResources" ], "Resource": "*" }, { "Sid": "EC2StartStopPermissions", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AutomationStartPermissions", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-StartStateManagerAssociations-*" ] }, { "Sid": "AssociationsStartOncePermissions", "Effect": "Allow", "Action": [ "ssm:StartAssociationsOnce" ], "Resource": [ "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "CreateSystemsManagerSLRPermissions", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "ReadOnlyPermissionsForEnablingExplorer", "Effect": "Allow", "Action": [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource": "*" }, { "Sid": "SSMExplorerServiceSettingsPermissions", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] } } }, "createdDate": "2024-06-26T09:53:37.000Z", "lastUpdatedDate": "2024-06-26T09:53:37.000Z" }, "AWSQuickSetupDeploymentRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupDeploymentRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:55:21.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CfnRead", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Sid": "CfnManage", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResourceDrifts", "cloudformation:DetectStackDrift", "cloudformation:DetectStackResourceDrift" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*" ] }, { "Sid": "RGroupsGet", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Sid": "CPacksRead", "Effect": "Allow", "Action": [ "config:DescribeConformancePacks", "config:DescribeConformancePackStatus" ], "Resource": "*" }, { "Sid": "OpsPacksManage", "Effect": "Allow", "Action": [ "config:PutConformancePack", "config:DeleteConformancePack" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": "arn:aws:config:*:*:conformance-pack/AWS-QuickSetup-*" }, { "Sid": "QSDocsManage", "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:DeleteDocument", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:ListTagsForResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/AWSOperationsPack-*", "arn:aws:ssm:*:*:document/AWSOperationsPackInstance-*" ] }, { "Sid": "QSDocsRead", "Effect": "Allow", "Action": [ "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/AWSOperationsPack*", "arn:aws:ssm:*::document/AWSConformancePacks-*", "arn:aws:ssm:*::document/AWSEC2-UpdateLaunchAgent", "arn:aws:ssm:*::document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*::document/AWS-RunPatchBaselineAssociation", "arn:aws:ssm:*::document/AWS-UpdateSSMAgent" ] }, { "Sid": "QSAssociationsManage", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/AWSOperationsPack*", "arn:aws:ssm:*::document/AWSEC2-UpdateLaunchAgent", "arn:aws:ssm:*::document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*::document/AWS-RunPatchBaselineAssociation", "arn:aws:ssm:*::document/AWS-UpdateSSMAgent", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "EventRulesManage", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:PutRule", "events:DeleteRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/*QuickSetup-*" ] }, { "Sid": "CPacksSLRCreate", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "config-conforms.amazonaws.com" } } }, { "Sid": "SSMSLRCreate", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "QSConfigRoleManage", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:GetRole", "iam:UpdateRole", "iam:DeleteRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoleTags", "iam:TagRole", "iam:UntagRole" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/AWSOperationsPack-*" ] }, { "Sid": "QSConfigRolePass", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/AWSOperationsPack-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com", "events.amazonaws.com" ] } } }, { "Sid": "DocDescribe", "Effect": "Allow", "Action": [ "ssm:DescribeDocument" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } } }, { "Sid": "LegacyDocClean", "Effect": "Allow", "Action": [ "ssm:DeleteDocument" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/QuickSetupID": "*" } } }, { "Sid": "LegacyIAMClean", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy" ], "Resource": "arn:aws:iam::*:role/*QuickSetup-*", "Condition": { "StringLike": { "aws:ResourceTag/QuickSetupID": "*" } } }, { "Sid": "QSConfigRoleBounded", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy", "iam:PutRolePermissionsBoundary" ], "Condition": { "StringEquals": { "iam:PermissionsBoundary": [ "arn:aws:iam::aws:policy/AWSQuickSetupCFGCPacksPermissionsBoundary", "arn:aws:iam::aws:policy/AWSQuickSetupCFGRecordingPermissionsBoundary", "arn:aws:iam::aws:policy/AWSQuickSetupDevOpsGuruPermissionsBoundary", "arn:aws:iam::aws:policy/AWSQuickSetupDistributorPermissionsBoundary", "arn:aws:iam::aws:policy/AWSQuickSetupSchedulerPermissionsBoundary", "arn:aws:iam::aws:policy/AWSQuickSetupSSMHostMgmtPermissionsBoundary" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/AWSOperationsPack-*" ] }, { "Sid": "QSConfigRoleManagedPolicies", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWSSystemsManagerEnableExplorerExecutionPolicy", "arn:aws:iam::aws:policy/AWSSystemsManagerEnableConfigRecordingExecutionPolicy" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/AWSOperationsPack-*" ] } ] } } }, "createdDate": "2024-06-26T09:55:21.000Z", "lastUpdatedDate": "2024-06-26T09:55:21.000Z" }, "AWSQuickSetupPatchPolicyDeploymentRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyDeploymentRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-26T09:57:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CfnRead", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Sid": "CfnManage", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResourceDrifts", "cloudformation:DetectStackDrift", "cloudformation:DetectStackResourceDrift" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*" ] }, { "Sid": "RGroupsGet", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": [ "*" ] }, { "Sid": "S3BucketsList", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": [ "*" ] }, { "Sid": "AccessLogsBucketManage", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:Put*", "s3:Get*", "s3:List*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": [ "arn:aws:s3:::aws-quicksetup-patchpolicy-access-log-*" ] }, { "Sid": "LambdaManage", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:UpdateFunction*", "lambda:GetFunction", "lambda:ListTags", "lambda:TagResource", "lambda:DeleteFunction", "lambda:InvokeFunction", "lambda:UntagResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } }, "Resource": [ "arn:aws:lambda:*:*:function:baseline-overrides-*", "arn:aws:lambda:*:*:function:delete-name-tags-*" ] }, { "Sid": "LogGroupsDescribe", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "LogGroupsManage", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource", "logs:PutRetentionPolicy", "logs:DeleteLogGroup", "logs:ListTagsForResource", "logs:UntagResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*", "arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*" ] }, { "Sid": "QSDocsManage", "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:DescribeDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:DeleteDocument", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:ListTagsForResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/QuickSetup-*" ] }, { "Sid": "QSDocsGet", "Effect": "Allow", "Action": [ "ssm:GetDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/QuickSetup-*", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-RunPatchBaseline" ] }, { "Sid": "QSAssociationsManage", "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ssm:*:*:document/QuickSetup-*", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-RunPatchBaseline", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "SSMSLRCreate", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Sid": "ConfigRoleManage", "Effect": "Allow", "Action": [ "iam:TagRole", "iam:UntagRole", "iam:GetRole", "iam:UpdateRole", "iam:DeleteRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoleTags" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ] }, { "Sid": "ConfigRolePassToSSM", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "ConfigRolePassToLambda", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "DocDescribe", "Effect": "Allow", "Action": [ "ssm:DescribeDocument" ], "Resource": "*" }, { "Sid": "LegacyDocClean", "Effect": "Allow", "Action": [ "ssm:DeleteDocument" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/QuickSetupID": "*" } } }, { "Sid": "LegacyIAMClean", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:DeleteRolePolicy" ], "Resource": "arn:aws:iam::*:role/*QuickSetup-*", "Condition": { "StringLike": { "aws:ResourceTag/QuickSetupID": "*" } } }, { "Sid": "ConfigRoleBoundedManage", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:AttachRolePolicy", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:PutRolePermissionsBoundary" ], "Condition": { "StringEquals": { "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ] } ] } } }, "createdDate": "2024-06-26T09:57:02.000Z", "lastUpdatedDate": "2024-06-26T09:57:02.000Z" }, "AmazonWorkSpacesPoolServiceAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesPoolServiceAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-06-27T16:21:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProvisioningWorkSpacesPoolPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "s3:ListAllMyBuckets" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "WorkSpacesPoolS3Permissions", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::wspool-logs-*", "arn:aws:s3:::wspool-app-settings-*", "arn:aws:s3:::wspool-home-folder-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-06-27T16:21:03.000Z", "lastUpdatedDate": "2024-06-27T16:21:03.000Z" }, "AmazonQDeveloperAccess": { "arn": "arn:aws:iam::aws:policy/AmazonQDeveloperAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2024-07-09T08:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQDeveloperAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:StartTroubleshootingResolutionExplanation", "q:GetTroubleshootingResults", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetaData" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } }, "v2": { "createdDate": "2024-07-09T08:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQDeveloperAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:StartTroubleshootingResolutionExplanation", "q:GetTroubleshootingResults", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetaData", "q:GenerateCodeFromCommands" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } }, "v3": { "createdDate": "2024-07-09T08:35:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQDeveloperAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest", "q:StartTroubleshootingAnalysis", "q:StartTroubleshootingResolutionExplanation", "q:GetTroubleshootingResults", "q:UpdateTroubleshootingCommandResult", "q:GetIdentityMetaData", "q:GenerateCodeFromCommands", "q:UsePlugin" ], "Resource": "*" }, { "Sid": "AllowCloudControlReadAccess", "Effect": "Allow", "Action": [ "cloudformation:GetResource", "cloudformation:ListResources" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] } } }, "createdDate": "2024-07-09T08:35:15.000Z", "lastUpdatedDate": "2024-11-13T21:30:27.000Z" }, "AppStudioServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AppStudioServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-07-10T05:01:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AppStudioResourcePermissionsForCloudWatch", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appstudio/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AppStudioResourcePermissionsForSecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:appstudio-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "IsAppStudioSecret" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/IsAppStudioSecret": "true" } } }, { "Sid": "AppStudioResourcePermissionsForSSO", "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso-directory:DescribeUsers", "sso-directory:ListMembersInGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2024-07-10T05:01:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AppStudioResourcePermissionsForCloudWatch", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/appstudio/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AppStudioResourcePermissionsForSecretsManager", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:appstudio-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "IsAppStudioSecret" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/IsAppStudioSecret": "true" } } }, { "Sid": "AppStudioResourcePermissionsForManagedSecrets", "Effect": "Allow", "Action": [ "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:appstudio!*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "appstudio" } } }, { "Sid": "AppStudioResourceWritePermissionsForManagedSecrets", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:appstudio!*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AppStudioResourcePermissionsForSSO", "Effect": "Allow", "Action": [ "sso:GetManagedApplicationInstance", "sso-directory:DescribeUsers", "sso-directory:ListMembersInGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-07-10T05:01:15.000Z", "lastUpdatedDate": "2025-03-13T20:37:07.000Z" }, "AmazonWorkSpacesThinClientReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesThinClientReadOnlyAccess", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2024-07-19T08:50:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowThinClientReadAccess", "Effect": "Allow", "Action": [ "thinclient:GetEnvironment", "thinclient:ListEnvironments", "thinclient:GetDevice", "thinclient:ListDevices", "thinclient:ListDeviceSessions", "thinclient:GetSoftwareSet", "thinclient:ListSoftwareSets", "thinclient:ListTagsForResource" ], "Resource": "arn:aws:thinclient:*:*:*" } ] } }, "v2": { "createdDate": "2024-07-19T08:50:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowThinClientReadAccess", "Effect": "Allow", "Action": [ "thinclient:GetDevice", "thinclient:GetEnvironment", "thinclient:GetSoftwareSet", "thinclient:ListDevices", "thinclient:ListDeviceSessions", "thinclient:ListEnvironments", "thinclient:ListSoftwareSets", "thinclient:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesAccess", "Effect": "Allow", "Action": [ "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesWebAccess", "Effect": "Allow", "Action": [ "workspaces-web:GetPortal", "workspaces-web:GetUserSettings", "workspaces-web:ListPortals" ], "Resource": "*" }, { "Sid": "AllowAppStreamAccess", "Effect": "Allow", "Action": [ "appstream:DescribeStacks" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2024-07-19T08:50:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowThinClientReadAccess", "Effect": "Allow", "Action": [ "thinclient:GetDevice", "thinclient:GetDeviceDetails", "thinclient:GetEnvironment", "thinclient:GetSoftwareSet", "thinclient:ListDevices", "thinclient:ListDeviceSessions", "thinclient:ListEnvironments", "thinclient:ListSoftwareSets", "thinclient:ListTagsForResource" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesAccess", "Effect": "Allow", "Action": [ "workspaces:DescribeConnectionAliases", "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesSecureBrowserAccess", "Effect": "Allow", "Action": [ "workspaces-web:GetPortal", "workspaces-web:GetUserSettings", "workspaces-web:ListPortals" ], "Resource": "*" }, { "Sid": "AllowAppStreamAccess", "Effect": "Allow", "Action": [ "appstream:DescribeStacks" ], "Resource": "*" } ] } } }, "createdDate": "2024-07-19T08:50:52.000Z", "lastUpdatedDate": "2025-01-09T16:52:05.000Z" }, "AmazonSageMakerCanvasEMRServerlessExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasEMRServerlessExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-07-27T00:35:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "S3Operations", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetObjectOperation", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*", "Condition": { "StringEqualsIgnoreCase": { "s3:ExistingObjectTag/SageMaker": "true" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3ListOperations", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-07-27T00:35:42.000Z", "lastUpdatedDate": "2024-07-27T00:35:42.000Z" }, "AmazonBedrockStudioPermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/AmazonBedrockStudioPermissionsBoundary", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-08-01T00:24:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessS3Buckets", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion", "s3:DeleteObjectVersion" ], "Resource": "arn:aws:s3:::br-studio-${aws:PrincipalAccount}-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessOpenSearchCollections", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "InvokeBedrockModels", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*::foundation-model/*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:ListTagsForResource", "bedrock:TagResource", "bedrock:UntagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonBedrockManaged": "true" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RetrieveAndGenerate", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "WriteLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/br-studio-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonBedrockManaged": "true" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "InvokeLambdaFunctions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:br-studio-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonBedrockManaged": "true" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AccessSecretsManagerSecrets", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:br-studio/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonBedrockManaged": "true" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "UseKmsKeyWithBedrock", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/EnableBedrock": "true" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "UseKmsKeyWithAwsServices", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/EnableBedrock": "true" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-08-01T00:24:40.000Z", "lastUpdatedDate": "2024-08-01T00:24:40.000Z" }, "AmazonWorkSpacesThinClientFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonWorkSpacesThinClientFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-08-09T07:25:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowThinClientFullAccess", "Effect": "Allow", "Action": [ "thinclient:*" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesAccess", "Effect": "Allow", "Action": [ "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesWebAccess", "Effect": "Allow", "Action": [ "workspaces-web:GetPortal", "workspaces-web:GetUserSettings", "workspaces-web:ListPortals" ], "Resource": "*" }, { "Sid": "AllowAppStreamAccess", "Effect": "Allow", "Action": [ "appstream:DescribeStacks" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-08-09T07:25:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowThinClientFullAccess", "Effect": "Allow", "Action": [ "thinclient:*" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesAccess", "Effect": "Allow", "Action": [ "workspaces:DescribeConnectionAliases", "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" }, { "Sid": "AllowWorkSpacesSecureBrowserAccess", "Effect": "Allow", "Action": [ "workspaces-web:GetPortal", "workspaces-web:GetUserSettings", "workspaces-web:ListPortals" ], "Resource": "*" }, { "Sid": "AllowAppStreamAccess", "Effect": "Allow", "Action": [ "appstream:DescribeStacks" ], "Resource": "*" } ] } } }, "createdDate": "2024-08-09T07:25:24.000Z", "lastUpdatedDate": "2025-01-09T16:52:06.000Z" }, "AWSCompromisedKeyQuarantineV3": { "arn": "arn:aws:iam::aws:policy/AWSCompromisedKeyQuarantineV3", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-08-21T17:36:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "cloudtrail:LookupEvents", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets", "ec2:PurchaseReservedInstancesOffering", "ec2:AcceptReservedInstancesExchangeQuote", "ec2:CreateReservedInstancesListing", "savingsplans:CreateSavingsPlan" ], "Resource": [ "*" ] } ] } }, "v2": { "createdDate": "2024-08-21T17:36:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "cloudtrail:LookupEvents", "ec2:RequestSpotInstances", "ec2:RunInstances", "ec2:StartInstances", "iam:AddUserToGroup", "iam:AttachGroupPolicy", "iam:AttachRolePolicy", "iam:AttachUserPolicy", "iam:ChangePassword", "iam:CreateAccessKey", "iam:CreateInstanceProfile", "iam:CreateLoginProfile", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser", "iam:DetachUserPolicy", "iam:PassRole", "iam:PutGroupPolicy", "iam:PutRolePolicy", "iam:PutUserPermissionsBoundary", "iam:PutUserPolicy", "iam:SetDefaultPolicyVersion", "iam:UpdateAccessKey", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAssumeRolePolicy", "iam:UpdateLoginProfile", "iam:UpdateUser", "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetPolicy", "lambda:ListTags", "lambda:PutProvisionedConcurrencyConfig", "lambda:TagResource", "lambda:UntagResource", "lambda:UpdateFunctionCode", "lightsail:Create*", "lightsail:Delete*", "lightsail:DownloadDefaultKeyPair", "lightsail:GetInstanceAccessDetails", "lightsail:Start*", "lightsail:Update*", "organizations:CreateAccount", "organizations:CreateOrganization", "organizations:InviteAccountToOrganization", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:PutBucketOwnershipControls", "s3:DeleteBucketPolicy", "s3:ObjectOwnerOverrideToBucketOwner", "s3:PutAccountPublicAccessBlock", "s3:PutBucketPolicy", "s3:ListAllMyBuckets", "ec2:PurchaseReservedInstancesOffering", "ec2:AcceptReservedInstancesExchangeQuote", "ec2:CreateReservedInstancesListing", "savingsplans:CreateSavingsPlan", "ecs:CreateService", "ecs:CreateCluster", "ecs:RegisterTaskDefinition", "ecr:GetAuthorizationToken", "bedrock:CreateModelInvocationJob", "bedrock:InvokeModelWithResponseStream", "bedrock:CreateFoundationModelAgreement", "bedrock:PutFoundationModelEntitlement", "bedrock:InvokeModel", "s3:CreateBucket", "s3:PutBucketCors", "s3:GetObject", "s3:ListBucket", "sagemaker:CreateEndpointConfig", "sagemaker:CreateProcessingJob", "ses:GetSendQuota", "ses:ListIdentities", "sts:GetSessionToken", "sts:GetFederationToken", "amplify:CreateDeployment", "amplify:CreateBackendEnvironment", "codebuild:CreateProject", "glue:CreateJob", "iam:DeleteRole", "iam:DeleteAccessKey", "iam:ListUsers", "lambda:GetEventSourceMapping", "sns:GetSMSAttributes", "mediapackagev2:CreateChannel" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-08-21T17:36:49.000Z", "lastUpdatedDate": "2024-10-02T16:52:27.000Z" }, "AWSPCSServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSPCSServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-08-27T16:01:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PermissionsToCreatePCSNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:RequestTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToCreatePCSNetworkInterfacesInSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "PermissionsToManagePCSNetworkInterfaces", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "Null": { "aws:ResourceTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToDescribePCSResources", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute" ], "Resource": "*" }, { "Sid": "PermissionsToCreatePCSLaunchTemplates", "Effect": "Allow", "Action": [ "ec2:CreateLaunchTemplate" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:RequestTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToManagePCSLaunchTemplates", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:CreateLaunchTemplateVersion" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "Null": { "aws:ResourceTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToTerminatePCSManagedInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:ResourceTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToPassRoleToEC2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/*/AWSPCS*", "arn:aws:iam::*:role/AWSPCS*", "arn:aws:iam::*:role/aws-pcs/*", "arn:aws:iam::*:role/*/aws-pcs/*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "PermissionsToControlClusterInstanceAttributes", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:resource-groups:*:*:group/*", "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:spot-instances-request/*" ] }, { "Sid": "PermissionsToProvisionClusterInstances", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Null": { "aws:RequestTag/AWSPCSManaged": "false" } } }, { "Sid": "PermissionsToTagPCSResources", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateLaunchTemplate", "CreateFleet", "CreateNetworkInterface" ] } } }, { "Sid": "PermissionsToPublishMetrics", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/PCS" } } }, { "Sid": "PermissionsToManageSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:pcs!*", "Condition": { "StringEquals": { "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "pcs", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-08-27T16:01:15.000Z", "lastUpdatedDate": "2024-08-27T16:01:15.000Z" }, "AmazonSageMakerHyperPodServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonSageMakerHyperPodServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-09-06T17:04:30.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EKSClusterDescribePermissions", "Effect": "Allow", "Action": "eks:DescribeCluster", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogStreamPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*:log-stream:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-09-06T17:04:30.000Z", "lastUpdatedDate": "2024-09-06T17:04:30.000Z" }, "AWSDirectoryServiceDataFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectoryServiceDataFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-09-18T21:45:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSDataFullAccess", "Effect": "Allow", "Action": [ "ds:AccessDSData", "ds-data:AddGroupMember", "ds-data:CreateGroup", "ds-data:CreateUser", "ds-data:DeleteGroup", "ds-data:DeleteUser", "ds-data:DescribeGroup", "ds-data:DescribeUser", "ds-data:DisableUser", "ds-data:ListGroupMembers", "ds-data:ListGroups", "ds-data:ListGroupsForMember", "ds-data:ListUsers", "ds-data:RemoveGroupMember", "ds-data:SearchGroups", "ds-data:SearchUsers", "ds-data:UpdateGroup", "ds-data:UpdateUser" ], "Resource": [ "arn:aws:ds:*:*:directory/*" ] } ] } } }, "createdDate": "2024-09-18T21:45:17.000Z", "lastUpdatedDate": "2024-09-18T21:45:17.000Z" }, "AWSDirectoryServiceDataReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSDirectoryServiceDataReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-09-18T22:00:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DSDataReadOnlyAccess", "Effect": "Allow", "Action": [ "ds:AccessDSData", "ds-data:DescribeGroup", "ds-data:DescribeUser", "ds-data:ListGroupMembers", "ds-data:ListGroups", "ds-data:ListGroupsForMember", "ds-data:ListUsers", "ds-data:SearchGroups", "ds-data:SearchUsers" ], "Resource": [ "arn:aws:ds:*:*:directory/*" ] } ] } } }, "createdDate": "2024-09-18T22:00:34.000Z", "lastUpdatedDate": "2024-09-18T22:00:34.000Z" }, "QAppsServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/QAppsServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-09-26T19:22:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "QAppsPutMetricDataPermission", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/QApps" } } } ] } } }, "createdDate": "2024-09-26T19:22:22.000Z", "lastUpdatedDate": "2024-09-26T19:22:22.000Z" }, "AmazonEKSWorkerNodeMinimalPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-02T20:03:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WorkerNodePermissions", "Effect": "Allow", "Action": [ "eks-auth:AssumeRoleForPodIdentity" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-02T20:03:51.000Z", "lastUpdatedDate": "2024-10-02T20:03:51.000Z" }, "AWSServiceRoleForProcurementInsightsPolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForProcurementInsightsPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-03T14:26:03.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ProcurementInsightsPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-10-03T14:26:03.000Z", "lastUpdatedDate": "2024-10-03T14:26:03.000Z" }, "AmazonEC2ContainerRegistryPullOnly": { "arn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-04T16:58:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchImportUpstreamImage" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-04T16:58:49.000Z", "lastUpdatedDate": "2024-10-04T16:58:49.000Z" }, "AWSDataSyncServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDataSyncServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-09T17:45:40.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataSyncCloudWatchLogCreateAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource": [ "arn:*:logs:*:*:log-group:/aws/datasync*" ] }, { "Sid": "DataSyncCloudWatchLogStreamUpdateAccess", "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:*:logs:*:*:log-group:/aws/datasync*:log-stream:*" ] } ] } } }, "createdDate": "2024-10-09T17:45:40.000Z", "lastUpdatedDate": "2024-10-09T17:45:40.000Z" }, "AWSDataExchangeServiceRolePolicyForOrganizationDiscovery": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDataExchangeServiceRolePolicyForOrganizationDiscovery", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-10T14:33:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAWSOrganizationsActions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:DescribeAccount", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-10-10T14:33:13.000Z", "lastUpdatedDate": "2024-10-10T14:33:13.000Z" }, "AWSDataExchangeServiceRolePolicyForLicenseManagement": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSDataExchangeServiceRolePolicyForLicenseManagement", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-10T14:54:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowLicenseManagerActions", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "license-manager:ListDistributedGrants", "license-manager:GetGrant", "license-manager:CreateGrantVersion", "license-manager:DeleteGrant" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-10-10T14:54:27.000Z", "lastUpdatedDate": "2024-10-10T14:54:27.000Z" }, "AWSSocialMessagingServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSocialMessagingServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-10T19:28:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudwatchMetricPublishing", "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/SocialMessaging" } } } ] } } }, "createdDate": "2024-10-10T19:28:38.000Z", "lastUpdatedDate": "2024-10-10T19:28:38.000Z" }, "ResourceGroupsTaggingAPITagUntagSupportedResources": { "arn": "arn:aws:iam::aws:policy/ResourceGroupsTaggingAPITagUntagSupportedResources", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-10-11T11:11:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:TagResource", "a4b:UntagResource", "access-analyzer:TagResource", "access-analyzer:UntagResource", "acm-pca:TagCertificateAuthority", "acm-pca:UntagCertificateAuthority", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "amplify:TagResource", "amplify:UntagResource", "appconfig:TagResource", "appconfig:UntagResource", "appflow:TagResource", "appflow:UntagResource", "appmesh:TagResource", "appmesh:UntagResource", "appstream:TagResource", "appstream:UntagResource", "appsync:TagResource", "appsync:UntagResource", "athena:TagResource", "athena:UntagResource", "auditmanager:TagResource", "auditmanager:UntagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "backup:TagResource", "backup:UntagResource", "batch:TagResource", "batch:UntagResource", "braket:TagResource", "braket:UntagResource", "cassandra:TagResource", "cassandra:UntagResource", "chime:TagResource", "chime:UntagResource", "cloud9:TagResource", "cloud9:UntagResource", "clouddirectory:TagResource", "clouddirectory:UntagResource", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudhsm:TagResource", "cloudhsm:UntagResource", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "cloudwatch:TagResource", "cloudwatch:UntagResource", "codeartifact:TagResource", "codeartifact:UntagResource", "codecommit:TagResource", "codecommit:UntagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "codedeploy:UntagResource", "codeguru-profiler:TagResource", "codeguru-profiler:UntagResource", "codepipeline:TagResource", "codepipeline:UntagResource", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar:TagProject", "codestar:UntagProject", "cognito-identity:TagResource", "cognito-identity:UntagResource", "cognito-idp:TagResource", "cognito-idp:UntagResource", "comprehend:TagResource", "comprehend:UntagResource", "config:TagResource", "config:UntagResource", "connect:TagResource", "connect:UntagResource", "dataexchange:TagResource", "dataexchange:UntagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "datasync:TagResource", "datasync:UntagResource", "deepcomposer:TagResource", "deepcomposer:UntagResource", "detective:TagResource", "detective:UntagResource", "devicefarm:TagResource", "devicefarm:UntagResource", "directconnect:TagResource", "directconnect:UntagResource", "dlm:TagResource", "dlm:UntagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "dynamodb:TagResource", "dynamodb:UntagResource", "ec2:CreateTags", "ec2:DeleteTags", "ecr:TagResource", "ecr:UntagResource", "ecs:TagResource", "ecs:UntagResource", "eks:TagResource", "eks:UntagResource", "elastic-inference:TagResource", "elastic-inference:UntagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "elasticbeanstalk:UpdateTagsForResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "emr-containers:TagResource", "emr-containers:UntagResource", "es:AddTags", "es:RemoveTags", "events:TagResource", "events:UntagResource", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "fms:TagResource", "fms:UntagResource", "forecast:TagResource", "forecast:UntagResource", "frauddetector:TagResource", "frauddetector:UntagResource", "fsx:TagResource", "fsx:UntagResource", "gamelift:TagResource", "gamelift:UntagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "globalaccelerator:TagResource", "globalaccelerator:UntagResource", "glue:TagResource", "glue:UntagResource", "greengrass:TagResource", "greengrass:UntagResource", "groundstation:TagResource", "groundstation:UntagResource", "guardduty:TagResource", "guardduty:UntagResource", "iam:TagInstanceProfile", "iam:TagMFADevice", "iam:TagOpenIDConnectProvider", "iam:TagPolicy", "iam:TagRole", "iam:TagSAMLProvider", "iam:TagServerCertificate", "iam:TagUser", "iam:UntagInstanceProfile", "iam:UntagMFADevice", "iam:UntagOpenIDConnectProvider", "iam:UntagPolicy", "iam:UntagRole", "iam:UntagSAMLProvider", "iam:UntagServerCertificate", "iam:UntagUser", "imagebuilder:TagResource", "imagebuilder:UntagResource", "inspector:ListTagsForResource", "inspector:SetTagsForResource", "iot1click:TagResource", "iot1click:UntagResource", "iot:TagResource", "iot:UntagResource", "iotanalytics:TagResource", "iotanalytics:UntagResource", "iotdeviceadvisor:TagResource", "iotdeviceadvisor:UntagResource", "iotevents:TagResource", "iotevents:UntagResource", "iotfleethub:TagResource", "iotfleethub:UntagResource", "iotsitewise:TagResource", "iotsitewise:UntagResource", "iottwinmaker:TagResource", "iottwinmaker:UntagResource", "iotwireless:TagResource", "iotwireless:UntagResource", "ivs:TagResource", "ivs:UntagResource", "kafka:TagResource", "kafka:UntagResource", "kendra:TagResource", "kendra:UntagResource", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisanalytics:UntagResource", "kms:TagResource", "kms:UntagResource", "lambda:TagResource", "lambda:UntagResource", "lex:TagResource", "lex:UntagResource", "license-manager:TagResource", "license-manager:UntagResource", "lightsail:TagResource", "lightsail:UntagResource", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource", "lookoutequipment:TagResource", "lookoutequipment:UntagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "macie2:TagResource", "macie2:UntagResource", "managedblockchain:TagResource", "managedblockchain:UntagResource", "mediaconnect:TagResource", "mediaconnect:UntagResource", "mediaconvert:TagResource", "mediaconvert:UntagResource", "medialive:CreateTags", "medialive:DeleteTags", "mediapackage-vod:TagResource", "mediapackage-vod:UntagResource", "mediapackage:TagResource", "mediapackage:UntagResource", "mediatailor:TagResource", "mediatailor:UntagResource", "mobiletargeting:TagResource", "mobiletargeting:UntagResource", "mq:CreateTags", "mq:DeleteTags", "neptune-graph:TagResource", "neptune-graph:UntagResource", "network-firewall:TagResource", "network-firewall:UntagResource", "networkmanager:TagResource", "networkmanager:UntagResource", "opsworks-cm:TagResource", "opsworks-cm:UntagResource", "opsworks:TagResource", "opsworks:UntagResource", "organizations:TagResource", "organizations:UntagResource", "outposts:TagResource", "outposts:UntagResource", "qldb:TagResource", "qldb:UntagResource", "quicksight:TagResource", "quicksight:UntagResource", "ram:TagResource", "ram:UntagResource", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "redshift:CreateTags", "redshift:DeleteTags", "resource-explorer-2:TagResource", "resource-explorer-2:UntagResource", "resource-groups:Tag", "resource-groups:Untag", "robomaker:TagResource", "robomaker:UntagResource", "route53:ChangeTagsForResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "route53resolver:TagResource", "route53resolver:UntagResource", "s3:GetBucketTagging", "s3:GetJobTagging", "s3:GetObjectTagging", "s3:GetObjectVersionTagging", "s3:GetStorageLensConfigurationTagging", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:TagResource", "s3:UntagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "savingsplans:TagResource", "savingsplans:UntagResource", "schemas:TagResource", "schemas:UntagResource", "secretsmanager:TagResource", "secretsmanager:UntagResource", "securityhub:TagResource", "securityhub:UntagResource", "servicediscovery:TagResource", "servicediscovery:UntagResource", "servicequotas:TagResource", "servicequotas:UntagResource", "ses:TagResource", "ses:UntagResource", "sns:TagResource", "sns:UntagResource", "sqs:TagQueue", "sqs:UntagQueue", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "states:TagResource", "states:UntagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "swf:TagResource", "swf:UntagResource", "synthetics:TagResource", "synthetics:UntagResource", "tag:GetResources", "tag:TagResources", "tag:UntagResources", "transfer:TagResource", "transfer:UntagResource", "waf-regional:TagResource", "waf-regional:UntagResource", "waf:TagResource", "waf:UntagResource", "wafv2:TagResource", "wafv2:UntagResource", "worklink:TagResource", "worklink:UntagResource", "workmail:TagResource", "workmail:UntagResource", "workspaces:CreateTags", "workspaces:DeleteTags", "xray:TagResource", "xray:UntagResource" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-10-11T11:11:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "a4b:TagResource", "a4b:UntagResource", "access-analyzer:TagResource", "access-analyzer:UntagResource", "acm-pca:TagCertificateAuthority", "acm-pca:UntagCertificateAuthority", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "amplify:TagResource", "amplify:UntagResource", "appconfig:TagResource", "appconfig:UntagResource", "appflow:TagResource", "appflow:UntagResource", "appmesh:TagResource", "appmesh:UntagResource", "appstream:TagResource", "appstream:UntagResource", "appsync:TagResource", "appsync:UntagResource", "athena:TagResource", "athena:UntagResource", "auditmanager:TagResource", "auditmanager:UntagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "backup:TagResource", "backup:UntagResource", "batch:TagResource", "batch:UntagResource", "braket:TagResource", "braket:UntagResource", "cassandra:TagResource", "cassandra:UntagResource", "chime:TagResource", "chime:UntagResource", "cloud9:TagResource", "cloud9:UntagResource", "clouddirectory:TagResource", "clouddirectory:UntagResource", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudhsm:TagResource", "cloudhsm:UntagResource", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "cloudwatch:TagResource", "cloudwatch:UntagResource", "codeartifact:TagResource", "codeartifact:UntagResource", "codecommit:TagResource", "codecommit:UntagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "codedeploy:UntagResource", "codeguru-profiler:TagResource", "codeguru-profiler:UntagResource", "codepipeline:TagResource", "codepipeline:UntagResource", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar:TagProject", "codestar:UntagProject", "cognito-identity:TagResource", "cognito-identity:UntagResource", "cognito-idp:TagResource", "cognito-idp:UntagResource", "comprehend:TagResource", "comprehend:UntagResource", "config:TagResource", "config:UntagResource", "connect:TagResource", "connect:UntagResource", "dataexchange:TagResource", "dataexchange:UntagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "datasync:TagResource", "datasync:UntagResource", "deepcomposer:TagResource", "deepcomposer:UntagResource", "detective:TagResource", "detective:UntagResource", "devicefarm:TagResource", "devicefarm:UntagResource", "directconnect:TagResource", "directconnect:UntagResource", "dlm:TagResource", "dlm:UntagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "dynamodb:TagResource", "dynamodb:UntagResource", "ec2:CreateTags", "ec2:DeleteTags", "ecr:TagResource", "ecr:UntagResource", "ecs:TagResource", "ecs:UntagResource", "eks:TagResource", "eks:UntagResource", "elastic-inference:TagResource", "elastic-inference:UntagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "elasticbeanstalk:UpdateTagsForResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "emr-containers:TagResource", "emr-containers:UntagResource", "es:AddTags", "es:RemoveTags", "events:TagResource", "events:UntagResource", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "fms:TagResource", "fms:UntagResource", "forecast:TagResource", "forecast:UntagResource", "frauddetector:TagResource", "frauddetector:UntagResource", "fsx:TagResource", "fsx:UntagResource", "gamelift:TagResource", "gamelift:UntagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "globalaccelerator:TagResource", "globalaccelerator:UntagResource", "glue:TagResource", "glue:UntagResource", "greengrass:TagResource", "greengrass:UntagResource", "groundstation:TagResource", "groundstation:UntagResource", "guardduty:TagResource", "guardduty:UntagResource", "iam:TagInstanceProfile", "iam:TagMFADevice", "iam:TagOpenIDConnectProvider", "iam:TagPolicy", "iam:TagRole", "iam:TagSAMLProvider", "iam:TagServerCertificate", "iam:TagUser", "iam:UntagInstanceProfile", "iam:UntagMFADevice", "iam:UntagOpenIDConnectProvider", "iam:UntagPolicy", "iam:UntagRole", "iam:UntagSAMLProvider", "iam:UntagServerCertificate", "iam:UntagUser", "imagebuilder:TagResource", "imagebuilder:UntagResource", "inspector:ListTagsForResource", "inspector:SetTagsForResource", "iot1click:TagResource", "iot1click:UntagResource", "iot:TagResource", "iot:UntagResource", "iotanalytics:TagResource", "iotanalytics:UntagResource", "iotdeviceadvisor:TagResource", "iotdeviceadvisor:UntagResource", "iotevents:TagResource", "iotevents:UntagResource", "iotfleethub:TagResource", "iotfleethub:UntagResource", "iotsitewise:TagResource", "iotsitewise:UntagResource", "iottwinmaker:TagResource", "iottwinmaker:UntagResource", "iotwireless:TagResource", "iotwireless:UntagResource", "ivs:TagResource", "ivs:UntagResource", "kafka:TagResource", "kafka:UntagResource", "kendra:TagResource", "kendra:UntagResource", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisanalytics:UntagResource", "kms:TagResource", "kms:UntagResource", "lambda:TagResource", "lambda:UntagResource", "lex:TagResource", "lex:UntagResource", "license-manager:TagResource", "license-manager:UntagResource", "lightsail:TagResource", "lightsail:UntagResource", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource", "lookoutequipment:TagResource", "lookoutequipment:UntagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "macie2:TagResource", "macie2:UntagResource", "managedblockchain:TagResource", "managedblockchain:UntagResource", "mediaconnect:TagResource", "mediaconnect:UntagResource", "mediaconvert:TagResource", "mediaconvert:UntagResource", "medialive:CreateTags", "medialive:DeleteTags", "mediapackage-vod:TagResource", "mediapackage-vod:UntagResource", "mediapackage:TagResource", "mediapackage:UntagResource", "mediatailor:TagResource", "mediatailor:UntagResource", "mobiletargeting:TagResource", "mobiletargeting:UntagResource", "mq:CreateTags", "mq:DeleteTags", "neptune-graph:TagResource", "neptune-graph:UntagResource", "network-firewall:TagResource", "network-firewall:UntagResource", "networkmanager:TagResource", "networkmanager:UntagResource", "opsworks-cm:TagResource", "opsworks-cm:UntagResource", "opsworks:TagResource", "opsworks:UntagResource", "organizations:TagResource", "organizations:UntagResource", "outposts:TagResource", "outposts:UntagResource", "qldb:TagResource", "qldb:UntagResource", "quicksight:TagResource", "quicksight:UntagResource", "ram:TagResource", "ram:UntagResource", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "redshift:CreateTags", "redshift:DeleteTags", "resource-explorer-2:TagResource", "resource-explorer-2:UntagResource", "resource-groups:Tag", "resource-groups:Untag", "robomaker:TagResource", "robomaker:UntagResource", "route53:ChangeTagsForResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "route53resolver:TagResource", "route53resolver:UntagResource", "s3:GetBucketTagging", "s3:GetJobTagging", "s3:GetObjectTagging", "s3:GetObjectVersionTagging", "s3:GetStorageLensConfigurationTagging", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:TagResource", "s3:UntagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "savingsplans:TagResource", "savingsplans:UntagResource", "schemas:TagResource", "schemas:UntagResource", "secretsmanager:TagResource", "secretsmanager:UntagResource", "securityhub:TagResource", "securityhub:UntagResource", "servicediscovery:TagResource", "servicediscovery:UntagResource", "servicequotas:TagResource", "servicequotas:UntagResource", "ses:TagResource", "ses:UntagResource", "sns:TagResource", "sns:UntagResource", "sqs:TagQueue", "sqs:UntagQueue", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "states:TagResource", "states:UntagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "swf:TagResource", "swf:UntagResource", "synthetics:TagResource", "synthetics:UntagResource", "tag:GetResources", "tag:TagResources", "tag:UntagResources", "transfer:TagResource", "transfer:UntagResource", "waf-regional:TagResource", "waf-regional:UntagResource", "waf:TagResource", "waf:UntagResource", "wafv2:TagResource", "wafv2:UntagResource", "worklink:TagResource", "worklink:UntagResource", "workmail:TagResource", "workmail:UntagResource", "workspaces:CreateTags", "workspaces:DeleteTags", "xray:TagResource", "xray:UntagResource", "kinesisvideo:TagResource", "kinesisvideo:UntagResource", "redshift-serverless:TagResource", "redshift-serverless:UntagResource", "route53-recovery-control-config:TagResource", "route53-recovery-control-config:UntagResource", "route53-recovery-readiness:TagResource", "route53-recovery-readiness:UntagResource", "ssm-contacts:TagResource", "ssm-contacts:UntagResource", "ssm-incidents:TagResource", "ssm-incidents:UntagResource", "vpc-lattice:TagResource", "vpc-lattice:UntagResource", "workspaces-web:TagResource", "workspaces-web:UntagResource" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-11T11:11:14.000Z", "lastUpdatedDate": "2024-12-11T17:51:30.000Z" }, "AmazonVerifiedPermissionsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonVerifiedPermissionsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-11T18:19:31.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccountLevelPermissions", "Effect": "Allow", "Action": [ "verifiedpermissions:CreatePolicyStore", "verifiedpermissions:ListPolicyStores" ], "Resource": "*" }, { "Sid": "PolicyStoreLevelPermissions", "Effect": "Allow", "Action": [ "verifiedpermissions:*" ], "Resource": [ "arn:aws:verifiedpermissions::*:policy-store/*" ] } ] } } }, "createdDate": "2024-10-11T18:19:31.000Z", "lastUpdatedDate": "2024-10-11T18:19:31.000Z" }, "AmazonVerifiedPermissionsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonVerifiedPermissionsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-11T18:25:51.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccountLevelPermissions", "Effect": "Allow", "Action": [ "verifiedpermissions:ListPolicyStores" ], "Resource": "*" }, { "Sid": "PolicyStoreLevelPermissions", "Effect": "Allow", "Action": [ "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:IsAuthorized", "verifiedpermissions:IsAuthorizedWithToken", "verifiedpermissions:ListIdentitySources", "verifiedpermissions:ListPolicies", "verifiedpermissions:ListPolicyTemplates" ], "Resource": [ "arn:aws:verifiedpermissions::*:policy-store/*" ] } ] } } }, "createdDate": "2024-10-11T18:25:51.000Z", "lastUpdatedDate": "2024-10-11T18:25:51.000Z" }, "CloudWatchLambdaApplicationSignalsExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/CloudWatchLambdaApplicationSignalsExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-16T19:09:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchApplicationSignalsXrayWritePermissions", "Effect": "Allow", "Action": [ "xray:PutTraceSegments" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchApplicationSignalsLogGroupWritePermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-10-16T19:09:17.000Z", "lastUpdatedDate": "2024-10-16T19:09:17.000Z" }, "CloudWatchInternetMonitorFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchInternetMonitorFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-22T21:02:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "FullAccessActions", "Effect": "Allow", "Action": [ "internetmonitor:CreateMonitor", "internetmonitor:DeleteMonitor", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:GetQueryResults", "internetmonitor:GetQueryStatus", "internetmonitor:Link", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "internetmonitor:StartQuery", "internetmonitor:StopQuery", "internetmonitor:TagResource", "internetmonitor:UntagResource", "internetmonitor:UpdateMonitor" ], "Resource": "*" }, { "Sid": "ServiceLinkedRoleActions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/internetmonitor.amazonaws.com/AWSServiceRoleForInternetMonitor", "Condition": { "StringEquals": { "iam:AWSServiceName": "internetmonitor.amazonaws.com" } } }, { "Sid": "RolePolicyActions", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/aws-service-role/internetmonitor.amazonaws.com/AWSServiceRoleForInternetMonitor", "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchInternetMonitorServiceRolePolicy" } } }, { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudfront:GetDistribution", "cloudfront:ListDistributions", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeLoadBalancers", "logs:DescribeLogGroups", "logs:GetQueryResults", "logs:StartQuery", "logs:StopQuery", "workspaces:DescribeWorkspaceDirectories" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-22T21:02:59.000Z", "lastUpdatedDate": "2024-10-22T21:02:59.000Z" }, "AWSDataExchangeDataGrantOwnerFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeDataGrantOwnerFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-24T14:43:43.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeActions", "Effect": "Allow", "Action": [ "dataexchange:CreateDataSet", "dataexchange:UpdateDataSet", "dataexchange:GetDataSet", "dataexchange:DeleteDataSet", "dataexchange:ListDataSets", "dataexchange:CreateRevision", "dataexchange:UpdateRevision", "dataexchange:GetRevision", "dataexchange:DeleteRevision", "dataexchange:RevokeRevision", "dataexchange:ListDataSetRevisions", "dataexchange:CreateAsset", "dataexchange:UpdateAsset", "dataexchange:GetAsset", "dataexchange:DeleteAsset", "dataexchange:ListRevisionAssets", "dataexchange:SendApiAsset", "dataexchange:CreateDataGrant", "dataexchange:GetDataGrant", "dataexchange:DeleteDataGrant", "dataexchange:ListDataGrants", "dataexchange:PublishToDataGrant", "dataexchange:SendDataSetNotification", "dataexchange:TagResource", "dataexchange:UntagResource" ], "Resource": "*" }, { "Sid": "DataExchangeJobsActions", "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "IMPORT_ASSETS_FROM_S3", "IMPORT_ASSET_FROM_SIGNED_URL", "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "IMPORT_ASSET_FROM_API_GATEWAY_API", "IMPORT_ASSETS_FROM_REDSHIFT_DATA_SHARES", "IMPORT_ASSETS_FROM_LAKE_FORMATION_TAG_POLICY" ] } } } ] } } }, "createdDate": "2024-10-24T14:43:43.000Z", "lastUpdatedDate": "2024-10-24T14:43:43.000Z" }, "AWSDataExchangeDataGrantReceiverFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSDataExchangeDataGrantReceiverFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-24T14:45:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataExchangeReadOnlyActions", "Effect": "Allow", "Action": [ "dataexchange:GetDataSet", "dataexchange:ListDataSets", "dataexchange:GetRevision", "dataexchange:ListDataSetRevisions", "dataexchange:GetAsset", "dataexchange:ListRevisionAssets", "dataexchange:SendApiAsset" ], "Resource": "*" }, { "Sid": "DataExchangeExportActions", "Effect": "Allow", "Action": [ "dataexchange:CreateJob", "dataexchange:StartJob", "dataexchange:CancelJob" ], "Resource": "*", "Condition": { "StringEquals": { "dataexchange:JobType": [ "EXPORT_ASSETS_TO_S3", "EXPORT_ASSET_TO_SIGNED_URL", "EXPORT_REVISIONS_TO_S3" ] } } }, { "Sid": "DataExchangeEventActionActions", "Effect": "Allow", "Action": [ "dataexchange:CreateEventAction", "dataexchange:UpdateEventAction", "dataexchange:DeleteEventAction", "dataexchange:GetEventAction", "dataexchange:ListEventActions" ], "Resource": "*" }, { "Sid": "DataExchangeDataGrantActions", "Effect": "Allow", "Action": [ "dataexchange:AcceptDataGrant", "dataexchange:ListReceivedDataGrants", "dataexchange:GetReceivedDataGrant" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-24T14:45:58.000Z", "lastUpdatedDate": "2024-10-24T14:45:58.000Z" }, "AWSCloudFrontVPCOriginServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSCloudFrontVPCOriginServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-24T17:45:25.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EC2Action1", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Condition": { "StringEquals": { "aws:RequestTag/aws.cloudfront.vpcorigin": "enabled" } }, "Resource": "arn:aws:ec2:*:*:network-interface/*" }, { "Sid": "EC2Action2", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "EC2Action3", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Condition": { "StringEquals": { "aws:RequestTag/aws.cloudfront.vpcorigin": "enabled" } }, "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "EC2Action4", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "EC2Action5", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Condition": { "StringEquals": { "aws:ResourceTag/aws.cloudfront.vpcorigin": "enabled" } }, "Resource": "*" }, { "Sid": "EC2Action6", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeSubnets", "ec2:DescribeRegions", "ec2:DescribeAddresses" ], "Resource": "*" }, { "Sid": "EC2Action7", "Effect": "Allow", "Action": "ec2:CreateTags", "Condition": { "StringEquals": { "aws:RequestTag/aws.cloudfront.vpcorigin": "enabled", "ec2:CreateAction": [ "CreateNetworkInterface", "CreateSecurityGroup" ] } }, "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "ElbAction1", "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" } ] } } }, "createdDate": "2024-10-24T17:45:25.000Z", "lastUpdatedDate": "2024-10-24T17:45:25.000Z" }, "AmazonEKSNetworkingPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-28T22:34:33.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "StringLike": { "aws:RequestTag/eks:kubernetes-cni-node-name": "*" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "eks:kubernetes-cni-node-name" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface", "ec2:UnassignPrivateIpAddresses", "ec2:UnassignIpv6Addresses", "ec2:AssignPrivateIpAddresses", "ec2:AssignIpv6Addresses" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } } ] } } }, "createdDate": "2024-10-28T22:34:33.000Z", "lastUpdatedDate": "2024-10-28T22:34:33.000Z" }, "AmazonEKSLoadBalancingPolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-10-30T20:18:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateRule", "ec2:CreateSecurityGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group-rule/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags" ], "Resource": "*", "Condition": { "StringEquals": { "elasticloadbalancing:CreateAction": [ "CreateLoadBalancer", "CreateTargetGroup", "CreateListener", "CreateRule" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "AuthorizeSecurityGroupIngress" ] } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:ModifyListenerAttributes", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:*/webacl/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "shield:DeleteProtection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "shield:TagResource" ], "Resource": "arn:aws:shield::*:protection/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2024-10-30T20:18:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateRule", "ec2:CreateSecurityGroup" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:RegisterTargets" ], "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group-rule/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:ResourceTag/Name": "eks-cluster-sg*" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags" ], "Resource": "*", "Condition": { "StringEquals": { "elasticloadbalancing:CreateAction": [ "CreateLoadBalancer", "CreateTargetGroup", "CreateListener", "CreateRule" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateSecurityGroup", "AuthorizeSecurityGroupIngress" ] } } }, { "Effect": "Allow", "Action": [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:ModifyListenerAttributes", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL" ], "Resource": [ "arn:aws:wafv2:*:*:*/webacl/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" ] }, { "Effect": "Allow", "Action": [ "shield:CreateProtection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "shield:DeleteProtection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "shield:TagResource" ], "Resource": "arn:aws:shield::*:protection/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "eks:eks-cluster-name", "ingress.eks.amazonaws.com/stack", "ingress.eks.amazonaws.com/resource", "service.eks.amazonaws.com/stack", "service.eks.amazonaws.com/resource" ] } } }, { "Effect": "Allow", "Action": [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:DescribeTargetGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcClassicLink", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeClassicLinkInstances", "ec2:DescribeRouteTables", "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", "ec2:DescribeVpcPeeringConnections" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing", "Condition": { "StringEquals": { "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" } } } ] } } }, "createdDate": "2024-10-30T20:18:06.000Z", "lastUpdatedDate": "2025-01-09T22:37:06.000Z" }, "AmazonEKSBlockStoragePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-10-30T20:18:13.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AttachVolume", "ec2:DetachVolume", "ec2:ModifyVolume", "ec2:EnableFastSnapshotRestores" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateVolume", "CreateSnapshot" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "eks:eks-cluster-name", "CSIVolumeName", "ebs.csi.eks.amazonaws.com/cluster", "kubernetes.io/cluster/*", "kubernetes.io/created-for/*", "Name", "KubernetesCluster" ] } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVolume" ], "Resource": "arn:aws:ec2:*:*:snapshot/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:volume/*" }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshot" ], "Resource": "arn:aws:ec2:*:*:snapshot/*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "eks:eks-cluster-name", "CSIVolumeSnapshotName", "ebs.csi.eks.amazonaws.com/cluster", "kubernetes.io/cluster/*", "Name" ] } } } ] } } }, "createdDate": "2024-10-30T20:18:13.000Z", "lastUpdatedDate": "2024-10-30T20:18:13.000Z" }, "AmazonEKSComputePolicy": { "arn": "arn:aws:iam::aws:policy/AmazonEKSComputePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-01T21:46:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "StringLike": { "aws:RequestTag/eks:kubernetes-node-class-name": "*", "aws:RequestTag/eks:kubernetes-node-pool-name": "*" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "eks:eks-cluster-name", "eks:kubernetes-node-class-name", "eks:kubernetes-node-pool-name", "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateFleet", "RunInstances", "CreateLaunchTemplate" ] } } }, { "Effect": "Allow", "Action": "iam:AddRoleToInstanceProfile", "Resource": "arn:aws:iam::*:instance-profile/eks-compute-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } } ] } }, "v2": { "createdDate": "2024-11-01T21:46:52.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateFleet", "ec2:RunInstances", "ec2:CreateLaunchTemplate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}" }, "StringLike": { "aws:RequestTag/eks:kubernetes-node-class-name": "*", "aws:RequestTag/eks:kubernetes-node-pool-name": "*" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "eks:eks-cluster-name", "eks:kubernetes-node-class-name", "eks:kubernetes-node-pool-name", "kubernetes.io/cluster/*" ] } } }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "CreateFleet", "RunInstances", "CreateLaunchTemplate" ] } } }, { "Effect": "Allow", "Action": "iam:AddRoleToInstanceProfile", "Resource": "arn:aws:iam::*:instance-profile/eks*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn" ] } } } ] } } }, "createdDate": "2024-11-01T21:46:52.000Z", "lastUpdatedDate": "2024-11-07T21:21:18.000Z" }, "GameLiftContainerFleetPolicy": { "arn": "arn:aws:iam::aws:policy/GameLiftContainerFleetPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-12T19:28:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WriteGameSessionLogsToLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*" }, { "Sid": "CreateLogGroupToStoreGameSessionLogs", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:gamelift-*" }, { "Sid": "WriteGameSessionLogsToS3Bucket", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::gamelift-*" ], "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RetrieveComputeAuthToken", "Effect": "Allow", "Action": [ "gamelift:GetComputeAuthToken" ], "Resource": [ "arn:aws:gamelift:*:*:containerfleet/*" ] } ] } }, "v2": { "createdDate": "2024-11-12T19:28:49.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "WriteGameSessionLogsToLogStream", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*" }, { "Sid": "CreateLogGroupToStoreGameSessionLogs", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "arn:aws:logs:*:*:log-group:gamelift-*" }, { "Sid": "WriteGameSessionLogsToS3Bucket", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::gamelift-*" ], "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RetrieveComputeAuthToken", "Effect": "Allow", "Action": [ "gamelift:GetComputeAuthToken" ], "Resource": [ "arn:aws:gamelift:*:*:containerfleet/*" ] } ] } } }, "createdDate": "2024-11-12T19:28:49.000Z", "lastUpdatedDate": "2025-02-05T20:37:06.000Z" }, "AmazonDataZoneBedrockModelManagementPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDataZoneBedrockModelManagementPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-12T22:14:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ManageApplicationInferenceProfile", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile", "bedrock:TagResource" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneProject" ] }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DeleteApplicationInferenceProfile", "Effect": "Allow", "Action": [ "bedrock:DeleteInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateApplicationInferenceProfileUsingFoundationModels", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid": "CreateApplicationInferenceProfileUsingBedrockModels", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-12T22:14:20.000Z", "lastUpdatedDate": "2024-11-12T22:14:20.000Z" }, "AmazonDataZoneBedrockModelConsumptionPolicy": { "arn": "arn:aws:iam::aws:policy/service-role/AmazonDataZoneBedrockModelConsumptionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-12T22:15:08.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "InvokeDomainInferenceProfiles", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true" } } } ] } } }, "createdDate": "2024-11-12T22:15:08.000Z", "lastUpdatedDate": "2024-11-12T22:15:08.000Z" }, "CloudWatchInternetMonitorReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchInternetMonitorReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-12T23:11:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyActions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "internetmonitor:GetHealthEvent", "internetmonitor:GetInternetEvent", "internetmonitor:GetMonitor", "internetmonitor:GetQueryResults", "internetmonitor:GetQueryStatus", "internetmonitor:ListHealthEvents", "internetmonitor:ListInternetEvents", "internetmonitor:ListMonitors", "internetmonitor:ListTagsForResource", "internetmonitor:StartQuery", "internetmonitor:StopQuery", "logs:DescribeLogGroups", "logs:GetQueryResults", "logs:StartQuery", "logs:StopQuery" ], "Resource": "*" } ] } } }, "createdDate": "2024-11-12T23:11:17.000Z", "lastUpdatedDate": "2024-11-12T23:11:17.000Z" }, "AmazonODBServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonODBServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-13T18:21:41.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/ODB" ] } } }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeAvailabilityZones" ], "Resource": "*" } ] } } }, "createdDate": "2024-11-13T18:21:41.000Z", "lastUpdatedDate": "2024-11-13T18:21:41.000Z" }, "SMSVoiceServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/SMSVoiceServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-14T17:04:34.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/SMSVoice" } } } ] } } }, "createdDate": "2024-11-14T17:04:34.000Z", "lastUpdatedDate": "2024-11-14T17:04:34.000Z" }, "AWSPartnerCentralOpportunityManagement": { "arn": "arn:aws:iam::aws:policy/AWSPartnerCentralOpportunityManagement", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-14T19:09:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OpportunityManagement", "Effect": "Allow", "Action": [ "partnercentral:AcceptEngagementInvitation", "partnercentral:AssignOpportunity", "partnercentral:AssociateOpportunity", "partnercentral:CreateOpportunity", "partnercentral:DisassociateOpportunity", "partnercentral:GetAwsOpportunitySummary", "partnercentral:GetEngagementInvitation", "partnercentral:GetOpportunity", "partnercentral:ListEngagementInvitations", "partnercentral:ListOpportunities", "partnercentral:ListSolutions", "partnercentral:RejectEngagementInvitation", "partnercentral:StartEngagementByAcceptingInvitationTask", "partnercentral:StartEngagementFromOpportunityTask", "partnercentral:SubmitOpportunity", "partnercentral:UpdateOpportunity" ], "Resource": "*" }, { "Sid": "ListingAWSMarketplaceEntities", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities" ], "Resource": "*" }, { "Sid": "AWSMarketplaceOffersAccess", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Offer/*" ] } ] } }, "v2": { "createdDate": "2024-11-14T19:09:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OpportunityManagement", "Effect": "Allow", "Action": [ "partnercentral:AcceptEngagementInvitation", "partnercentral:AssignOpportunity", "partnercentral:AssociateOpportunity", "partnercentral:CreateEngagement", "partnercentral:CreateEngagementInvitation", "partnercentral:CreateOpportunity", "partnercentral:CreateResourceSnapshot", "partnercentral:CreateResourceSnapshotJob", "partnercentral:DeleteResourceSnapshotJob", "partnercentral:DisassociateOpportunity", "partnercentral:GetAwsOpportunitySummary", "partnercentral:GetEngagement", "partnercentral:GetEngagementInvitation", "partnercentral:GetOpportunity", "partnercentral:GetResourceSnapshot", "partnercentral:GetResourceSnapshotJob", "partnercentral:ListEngagementByAcceptingInvitationTasks", "partnercentral:ListEngagementFromOpportunityTasks", "partnercentral:ListEngagementInvitations", "partnercentral:ListEngagementMembers", "partnercentral:ListEngagementResourceAssociations", "partnercentral:ListEngagements", "partnercentral:ListOpportunities", "partnercentral:ListResourceSnapshotJobs", "partnercentral:ListResourceSnapshots", "partnercentral:ListSolutions", "partnercentral:RejectEngagementInvitation", "partnercentral:StartEngagementByAcceptingInvitationTask", "partnercentral:StartEngagementFromOpportunityTask", "partnercentral:StartResourceSnapshotJob", "partnercentral:StopResourceSnapshotJob", "partnercentral:SubmitOpportunity", "partnercentral:UpdateOpportunity" ], "Resource": "*" }, { "Sid": "ListingAWSMarketplaceEntities", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities" ], "Resource": "*" }, { "Sid": "AWSMarketplaceOffersAccess", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Offer/*" ] } ] } } }, "createdDate": "2024-11-14T19:09:05.000Z", "lastUpdatedDate": "2024-12-04T23:06:07.000Z" }, "AWSPartnerCentralSandboxFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPartnerCentralSandboxFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-14T19:10:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSPartnerCentralSandboxAccess", "Effect": "Allow", "Action": [ "partnercentral:*" ], "Resource": "*", "Condition": { "StringEquals": { "partnercentral:Catalog": "Sandbox" } } } ] } }, "v2": { "createdDate": "2024-11-14T19:10:37.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSPartnerCentralSandboxAccess", "Effect": "Allow", "Action": [ "partnercentral:*" ], "Resource": "*", "Condition": { "StringEquals": { "partnercentral:Catalog": "Sandbox" } } }, { "Sid": "PassAWSPartnerCentralSnapshotJobRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*" ], "Condition": { "StringEquals": { "iam:PassedToService": "resource-snapshot-job.partnercentral-selling.amazonaws.com" } } } ] } } }, "createdDate": "2024-11-14T19:10:37.000Z", "lastUpdatedDate": "2024-12-10T18:21:19.000Z" }, "SecurityLakeResourceManagementServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/SecurityLakeResourceManagementServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-14T22:10:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadEventBridgeRules", "Effect": "Allow", "Action": [ "events:ListRules" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageSecurityLakeEventRules", "Effect": "Allow", "Action": [ "events:PutRule" ], "Resource": "arn:aws:events:*:*:rule/AmazonSecurityLake-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageSecurityLakeLambdaConfigurations", "Effect": "Allow", "Action": [ "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:PutFunctionConcurrency", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetFunctionConcurrency", "lambda:GetRuntimeManagementConfig", "lambda:PutProvisionedConcurrencyConfig", "lambda:PublishVersion", "lambda:DeleteFunctionConcurrency", "lambda:DeleteEventSourceMapping", "lambda:GetAlias", "lambda:GetPolicy", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListLambdaEventSourceMappings", "Effect": "Allow", "Action": [ "lambda:ListEventSourceMappings" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowUpdateLambdaEventSourceMapping", "Effect": "Allow", "Action": [ "lambda:UpdateEventSourceMapping" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "lambda:FunctionArn": "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*" } } }, { "Sid": "AllowUpdateLambdaConfigs", "Effect": "Allow", "Action": [ "lambda:UpdateFunctionConfiguration" ], "Resource": "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageSecurityLakeGlueResources", "Effect": "Allow", "Action": [ "glue:CreatePartition", "glue:BatchCreatePartition", "glue:GetTable", "glue:GetTables", "glue:UpdateTable", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDataLakeConfigurationManagement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObjectAttributes", "s3:GetBucketNotification", "s3:PutBucketNotification", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetEncryptionConfiguration", "s3:GetReplicationConfiguration" ], "Resource": [ "arn:aws:s3:::aws-security-data-lake*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowMetaDataCompactionAndManagement", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:DeleteObject", "s3:RestoreObject" ], "Resource": [ "arn:aws:s3:::aws-security-data-lake*/metadata/*.avro", "arn:aws:s3:::aws-security-data-lake*/metadata/*.metadata.json" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ReadSecurityLakeLambdaLogs", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetQueryResults", "logs:GetLogRecord" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/lambda/AmazonSecurityLakeMetastoreManager-*-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageSecurityLakeSQSQueue", "Effect": "Allow", "Action": [ "sqs:StartMessageMoveTask", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility", "sqs:ListMessageMoveTasks", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes" ], "Resource": [ "arn:aws:sqs:*:*:SecurityLake_*", "arn:aws:sqs:*:*:AmazonSecurityLakeManager-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDataLakeManagement", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-14T22:10:14.000Z", "lastUpdatedDate": "2024-11-14T22:10:14.000Z" }, "SQSUnlockQueuePolicy": { "arn": "arn:aws:iam::aws:policy/root-task/SQSUnlockQueuePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-06T21:51:02.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOtherActionsOnAnyResource", "Effect": "Deny", "NotAction": [ "sqs:SetQueueAttributes", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl" ], "Resource": "*" }, { "Sid": "DenyGettingQueueAttributesOnNonOwnQueue", "Effect": "Deny", "Action": [ "sqs:GetQueueAttributes" ], "Resource": "arn:aws:sqs:*:*:*", "Condition": { "StringNotEqualsIfExists": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } }, { "Sid": "DenyActionsForNonRootUser", "Effect": "Deny", "Action": [ "sqs:SetQueueAttributes", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl" ], "Resource": "*", "Condition": { "StringNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:root" } } } ] } } }, "createdDate": "2024-11-06T21:51:02.000Z", "lastUpdatedDate": "2024-11-06T21:51:02.000Z" }, "S3UnlockBucketPolicy": { "arn": "arn:aws:iam::aws:policy/root-task/S3UnlockBucketPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-06T21:55:56.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOtherActionsOnAnyResource", "Effect": "Deny", "NotAction": [ "s3:DeleteBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketPolicy", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "DenyManagingBucketPolicyForNonRootCallers", "Effect": "Deny", "Action": [ "s3:DeleteBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketPolicy", "s3:ListAllMyBuckets" ], "Resource": "*", "Condition": { "StringNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:root" } } } ] } } }, "createdDate": "2024-11-06T21:55:56.000Z", "lastUpdatedDate": "2024-11-06T21:55:56.000Z" }, "IAMAuditRootUserCredentials": { "arn": "arn:aws:iam::aws:policy/root-task/IAMAuditRootUserCredentials", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-06T22:27:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOtherActionsOnAnyResource", "Effect": "Deny", "NotAction": [ "iam:ListAccessKeys", "iam:ListSigningCertificates", "iam:GetLoginProfile", "iam:ListMFADevices", "iam:GetAccountSummary", "iam:GetUser", "iam:GetAccessKeyLastUsed" ], "Resource": "*" }, { "Sid": "DenyAuditingCredentialsOnNonRootUserResource", "Effect": "Deny", "Action": [ "iam:ListAccessKeys", "iam:ListSigningCertificates", "iam:GetLoginProfile", "iam:ListMFADevices", "iam:GetUser", "iam:GetAccessKeyLastUsed" ], "NotResource": "arn:aws:iam::*:root" } ] } } }, "createdDate": "2024-11-06T22:27:58.000Z", "lastUpdatedDate": "2024-11-06T22:27:58.000Z" }, "IAMCreateRootUserPassword": { "arn": "arn:aws:iam::aws:policy/root-task/IAMCreateRootUserPassword", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-06T22:32:59.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOtherActionsOnAnyResource", "Effect": "Deny", "NotAction": [ "iam:CreateLoginProfile", "iam:GetLoginProfile" ], "Resource": "*" }, { "Sid": "DenyCreatingPasswordOnNonRootUserResource", "Effect": "Deny", "Action": [ "iam:CreateLoginProfile", "iam:GetLoginProfile" ], "NotResource": "arn:aws:iam::*:root" } ] } } }, "createdDate": "2024-11-06T22:32:59.000Z", "lastUpdatedDate": "2024-11-06T22:32:59.000Z" }, "IAMDeleteRootUserCredentials": { "arn": "arn:aws:iam::aws:policy/root-task/IAMDeleteRootUserCredentials", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-06T22:47:58.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOtherActionsOnAnyResource", "Effect": "Deny", "NotAction": [ "iam:DeleteAccessKey", "iam:DeleteSigningCertificate", "iam:DeleteLoginProfile", "iam:DeactivateMFADevice", "iam:DeleteVirtualMFADevice", "iam:ListAccessKeys", "iam:ListSigningCertificates", "iam:GetLoginProfile", "iam:ListMFADevices", "iam:GetUser", "iam:GetAccessKeyLastUsed" ], "Resource": "*" }, { "Sid": "DenyDeletingRootUserCredentialsOnNonRootUserResource", "Effect": "Deny", "Action": [ "iam:DeleteAccessKey", "iam:DeleteSigningCertificate", "iam:DeleteLoginProfile", "iam:DeactivateMFADevice", "iam:DeleteVirtualMFADevice", "iam:ListAccessKeys", "iam:ListSigningCertificates", "iam:GetLoginProfile", "iam:ListMFADevices", "iam:GetUser", "iam:GetAccessKeyLastUsed" ], "NotResource": "arn:aws:iam::*:root" } ] } } }, "createdDate": "2024-11-06T22:47:58.000Z", "lastUpdatedDate": "2024-11-06T22:47:58.000Z" }, "AmazonECSInfrastructureRolePolicyForVpcLattice": { "arn": "arn:aws:iam::aws:policy/AmazonECSInfrastructureRolePolicyForVpcLattice", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T20:02:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ManagedVpcLatticeTargetRegistration", "Effect": "Allow", "Action": [ "vpc-lattice:RegisterTargets", "vpc-lattice:DeregisterTargets" ], "Resource": [ "arn:aws:vpc-lattice:*:*:targetgroup/*" ] }, { "Sid": "DescribeVpcLatticeTargetGroup", "Effect": "Allow", "Action": "vpc-lattice:GetTargetGroup", "Resource": [ "arn:aws:vpc-lattice:*:*:targetgroup/*" ] }, { "Sid": "ListVpcLatticeTargets", "Effect": "Allow", "Action": "vpc-lattice:ListTargets", "Resource": [ "arn:aws:vpc-lattice:*:*:targetgroup/*" ] }, { "Sid": "DescribeEc2Resources", "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeInstances" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-11-15T20:02:55.000Z", "lastUpdatedDate": "2024-11-15T20:02:55.000Z" }, "AWSQuickSetupEnableDHMCExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupEnableDHMCExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T21:27:47.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-DefaultEC2MgmtRole-*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-DefaultEC2MgmtRole-*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-DefaultEC2MgmtRole-*", "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy" } } }, { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:*:*:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" } ] } } }, "createdDate": "2024-11-15T21:27:47.000Z", "lastUpdatedDate": "2024-11-15T21:27:47.000Z" }, "AWSQuickSetupManagedInstanceProfileExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupManagedInstanceProfileExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T21:51:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:ListInstanceProfilesForRole" ], "Resource": "*" }, { "Sid": "DefaultInstanceRoleManagePermissions", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" }, { "Sid": "DefaultInstanceProfileCreatePermissions", "Effect": "Allow", "Action": [ "iam:CreateInstanceProfile" ], "Resource": [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceRoleAddPermissions", "Effect": "Allow", "Action": "iam:AddRoleToInstanceProfile", "Resource": [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid": "DefaultInstanceProfileAssociationPermissions", "Effect": "Allow", "Action": [ "ec2:AssociateIamInstanceProfile" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "ec2:InstanceProfile": "true" }, "ArnLike": { "ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid": "DefaultInstanceRolePassToEC2Permissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup", "Condition": { "StringEquals": { "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "InstanceManagementPoliciesAttachAmazonSSMManagedInstanceCore", "Effect": "Allow", "Action": "iam:AttachRolePolicy", "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AmazonSSMPatchAssociation", "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess", "arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils" ] } }, "Resource": "arn:aws:iam::*:role/*" }, { "Sid": "InstanceProfileAssociationEc2Permissions", "Effect": "Allow", "Action": [ "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "AutomationsStartWithTagPermissions", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:AddTagsToResource" ], "Resource": [ "arn:aws:ssm:*:*:automation-execution/*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*" ], "Condition": { "StringEquals": { "aws:RequestTag/InvokedBy": [ "AWSQuickSetupType-ManageInstanceProfile" ], "aws:ResourceTag/InvokedBy": [ "AWSQuickSetupType-ManageInstanceProfile" ] } } }, { "Sid": "AutomationsGetPermissions", "Effect": "Allow", "Action": "ssm:GetAutomationExecution", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/InvokedBy": [ "AWSQuickSetupType-ManageInstanceProfile" ] } } }, { "Sid": "GetQuickSetupAutomationAssumeRoles", "Effect": "Allow", "Action": "iam:GetRole", "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "iam:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM", "AWSQuickSetupType-SSMHostMgmt", "AWSQuickSetupType-PatchPolicy", "AWSQuickSetupType-Distributor" ] } } }, { "Sid": "PassQuickSetupAutomationAssumeRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ], "iam:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM", "AWSQuickSetupType-SSMHostMgmt", "AWSQuickSetupType-PatchPolicy", "AWSQuickSetupType-Distributor" ] } } } ] } } }, "createdDate": "2024-11-15T21:51:23.000Z", "lastUpdatedDate": "2024-11-15T21:51:23.000Z" }, "AWSQuickSetupSSMLifecycleManagementExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T21:55:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ], "iam:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] } } }, { "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:AddTagsToResource" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWSQuickSetupType-SSM-ManageResources*", "arn:aws:ssm:*:*:automation-execution/*" ], "Condition": { "StringEquals": { "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM", "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } } ] } } }, "createdDate": "2024-11-15T21:55:57.000Z", "lastUpdatedDate": "2024-11-15T21:55:57.000Z" }, "AWSQuickSetupSSMDeploymentS3BucketRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMDeploymentS3BucketRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T22:01:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutBucketTagging", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": "arn:aws:s3:::do-not-delete-ssm-*" } ] } } }, "createdDate": "2024-11-15T22:01:44.000Z", "lastUpdatedDate": "2024-11-15T22:01:44.000Z" }, "AWSQuickSetupEnableAREXExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupEnableAREXExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T22:45:53.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadActions", "Effect": "Allow", "Action": [ "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListViews" ], "Resource": "*" }, { "Sid": "AllowUpdateExistingIndexAndAssociateDefaultView", "Effect": "Allow", "Action": [ "resource-explorer-2:UpdateIndexType", "resource-explorer-2:AssociateDefaultView" ], "Resource": "*" }, { "Sid": "AllowCreateViewAndIndex", "Effect": "Allow", "Action": [ "resource-explorer-2:CreateView", "resource-explorer-2:CreateIndex", "resource-explorer-2:TagResource" ], "Resource": [ "arn:aws:resource-explorer-2:*:*:view/all-resources/*", "arn:aws:resource-explorer-2:*:*:index/*" ], "Condition": { "StringEquals": { "aws:RequestTag/Type": "QuickSetup", "aws:ResourceTag/Type": "QuickSetup" }, "ForAllValues:StringEquals": { "aws:TagKeys": "Type" } } }, { "Sid": "AllowCreateServiceLinkedRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "resource-explorer-2.amazonaws.com" ] } }, "Resource": "arn:aws:iam::*:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer" } ] } } }, "createdDate": "2024-11-15T22:45:53.000Z", "lastUpdatedDate": "2024-11-15T22:45:53.000Z" }, "AWSQuickSetupSSMManageResourcesExecutionPolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMManageResourcesExecutionPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T22:49:24.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:TagRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableExplorer*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableDHMC*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageInstanceProfile*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableAREX*" ], "Condition": { "StringEquals": { "iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM", "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } }, { "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:GetRole", "iam:GetRolePolicy", "iam:UpdateRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableExplorer*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableDHMC*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageInstanceProfile*", "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableAREX*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWSSystemsManagerEnableExplorerExecutionPolicy" ] } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableExplorer*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupEnableDHMCExecutionPolicy" } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableDHMC*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupManagedInstanceProfileExecutionPolicy" } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageInstanceProfile*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupEnableAREXExecutionPolicy" } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-EnableAREX*" }, { "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:ListBucketVersions", "s3:DeleteObjectVersion", "s3:GetObjectVersion", "s3:GetObject" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-*", "Condition": { "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ] } } } ] } } }, "createdDate": "2024-11-15T22:49:24.000Z", "lastUpdatedDate": "2024-11-15T22:49:24.000Z" }, "AWSQuickSetupSSMDeploymentRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMDeploymentRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-15T22:53:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResourceDrifts", "cloudformation:DetectStackDrift", "cloudformation:DetectStackResourceDrift" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:TagResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ], "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ], "aws:RequestTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "QuickSetup*" ] } }, "Resource": [ "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunction*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ], "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] } }, "Resource": [ "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation", "ssm:GetDocument", "ssm:DescribeDocument" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*::document/AWSQuickSetupType-EnableAREX", "arn:aws:ssm:*::document/AWSQuickSetupType-EnableDHMC", "arn:aws:ssm:*::document/AWSQuickSetupType-ManageInstanceProfile", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*::document/AWS-UpdateSSMAgent", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "SSMSLRCreate", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:TagRole" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "QuickSetup*" ] }, "StringEquals": { "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ], "aws:RequestTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-*", "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateRole", "iam:DeleteRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoleTags" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-*", "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement-*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupSSMManageResourcesExecutionPolicy" } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources-*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-AdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-ExecutionRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-Automation-DiagnosisBucketPolicy", "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup*" ], "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com", "iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement*" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com", "iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } } ] } }, "v2": { "createdDate": "2024-11-15T22:53:20.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListStacks" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResourceDrifts", "cloudformation:DetectStackDrift", "cloudformation:DetectStackResourceDrift", "cloudformation:DescribeStackEvents" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*" ] }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:TagResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ], "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ], "aws:RequestTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "QuickSetup*" ] } }, "Resource": [ "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" ] }, { "Effect": "Allow", "Action": [ "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunction*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": [ "${aws:PrincipalAccount}" ], "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] } }, "Resource": [ "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" ] }, { "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "cloudformation.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*" }, { "Effect": "Allow", "Action": [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation", "ssm:GetDocument", "ssm:DescribeDocument" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:ssm:*::document/AWSQuickSetupType-EnableAREX", "arn:aws:ssm:*::document/AWSQuickSetupType-EnableDHMC", "arn:aws:ssm:*::document/AWSQuickSetupType-ManageInstanceProfile", "arn:aws:ssm:*::document/AWS-EnableExplorer", "arn:aws:ssm:*::document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*::document/AWS-UpdateSSMAgent", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid": "SSMSLRCreate", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition": { "StringEquals": { "iam:AWSServiceName": "ssm.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:TagRole" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] }, "ForAnyValue:StringLike": { "aws:TagKeys": [ "QuickSetup*" ] }, "StringEquals": { "aws:ResourceTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ], "aws:RequestTag/QuickSetupDocument": [ "AWSQuickSetupType-SSM" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-*", "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateRole", "iam:DeleteRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoleTags" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "cloudformation.amazonaws.com" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-*", "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement-*" ] }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupSSMManageResourcesExecutionPolicy" } }, "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources-*" }, { "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-AdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-ExecutionRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-Automation-DiagnosisBucketPolicy", "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy", "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy" ] } }, "Resource": [ "arn:aws:iam::*:role/AWS-SSM-Remediation*", "arn:aws:iam::*:role/AWS-SSM-Diagnosis*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup*" ], "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com", "iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement*" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com", "iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM" } } } ] } } }, "createdDate": "2024-11-15T22:53:20.000Z", "lastUpdatedDate": "2024-11-20T12:43:56.000Z" }, "AWS-SSM-Automation-DiagnosisBucketPolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-Automation-DiagnosisBucketPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-15T23:31:17.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadWriteToSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*/actions/*/${aws:PrincipalAccount}/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowReadWriteToSsmDiagnosisBucketWithinOrg", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*/actions/*/${aws:PrincipalAccount}/*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } }, { "Sid": "AllowReadOnlyAccessListBucketOnSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "s3:prefix": "*/${aws:PrincipalAccount}/*" } } }, { "Sid": "AllowReadOnlyAccessListBucketOnSsmDiagnosisBucketWithinOrg", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" }, "StringLike": { "s3:prefix": "*/${aws:PrincipalAccount}/*" } } }, { "Sid": "AllowGetEncryptionConfigurationOnSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowGetEncryptionConfigurationOnSsmDiagnosisBucketWithinOrg", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } } ] } } }, "createdDate": "2024-11-15T23:31:17.000Z", "lastUpdatedDate": "2024-11-15T23:31:17.000Z" }, "AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:01:45.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessSSMResource", "Effect": "Allow", "Action": [ "ssm:DescribeAutomationExecutions", "ssm:DescribeAutomationStepExecutions", "ssm:GetAutomationExecution" ], "Resource": "*" }, { "Sid": "AllowExecuteSSMAutomation", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-*UnmanagedEC2*:*" ] }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowAssumeDiagnosisExecutionRoleWithinAccount", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-DiagnosisExecutionRole*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowPassRoleOnSelfToSsm", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-DiagnosisAdminRole*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Sid": "AllowReadWriteToSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*/actions/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListBucketOnSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-16T00:01:45.000Z", "lastUpdatedDate": "2024-11-16T00:01:45.000Z" }, "AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:08:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessEC2Resource", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeInternetGateways" ], "Resource": "*" }, { "Sid": "AllowReadOnlyAccessSSMResource", "Effect": "Allow", "Action": [ "ssm:DescribeAutomationStepExecutions", "ssm:DescribeInstanceInformation", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution" ], "Resource": "*" }, { "Sid": "AllowExecuteSSMAutomation", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-*UnmanagedEC2*:*" ] }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowPassRoleOnSelfToSsm", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-DiagnosisExecutionRole*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } } }, "createdDate": "2024-11-16T00:08:07.000Z", "lastUpdatedDate": "2024-11-16T00:08:07.000Z" }, "AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:11:14.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessOrganization", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "AllowAssumeDiagnosisExecutionRoleWithinOrg", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-DiagnosisExecutionRole*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } } ] } } }, "createdDate": "2024-11-16T00:11:14.000Z", "lastUpdatedDate": "2024-11-16T00:11:14.000Z" }, "AWS-SSM-RemediationAutomation-AdministrationRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-AdministrationRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:14:44.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessSSMResource", "Effect": "Allow", "Action": [ "ssm:DescribeAutomationExecutions", "ssm:DescribeAutomationStepExecutions", "ssm:GetAutomationExecution" ], "Resource": "*" }, { "Sid": "AllowExecuteSSMAutomation", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-OrchestrateUnmanagedEC2Actions:*", "arn:aws:ssm:*:*:automation-definition/AWS-RemediateSSMAgent*:*" ] }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowAssumeRemediationExecutionRoleWithinAccount", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-RemediationExecutionRole*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowPassRoleOnSelfToSsm", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-RemediationAdminRole*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Sid": "AllowReadWriteToSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*/actions/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowListBucketOnSsmDiagnosisBucketInSameAccount", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-16T00:14:44.000Z", "lastUpdatedDate": "2024-11-16T00:14:44.000Z" }, "AWS-SSM-RemediationAutomation-ExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-ExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:17:57.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessSSMResource", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:DescribeAutomationExecutions", "ssm:DescribeAutomationStepExecutions" ], "Resource": "*" }, { "Sid": "AllowReadOnlyAccessEC2Resource", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Sid": "AllowCreateVpcEndpointForTaggedSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManager::FindingNetworkingSecurityGroups::VPCE::SG": "VPCEndpointSecurityGroup" } } }, { "Sid": "AllowCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Sid": "RestrictCreateVpcEndpointForSSMService", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.ssm", "com.amazonaws.*.ssmmessages", "com.amazonaws.*.ec2messages" ] }, "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingVPCEndpoints::VPCE": "VPCEndpoint" } } }, { "Sid": "RestrictCreateVpcEndpointWithTag", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingVPCEndpoints::VPCE": "VPCEndpoint", "ec2:CreateAction": [ "CreateVpcEndpoint" ] } } }, { "Sid": "AllowModifyVpcAttributeForDns", "Effect": "Allow", "Action": [ "ec2:ModifyVpcAttribute" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "ec2:Attribute": [ "EnableDnsSupport", "EnableDnsHostnames" ] } } }, { "Sid": "AllowSecurityGroupRuleUpdate", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AllowSecurityGroupRuleUpdateForTaggedResource", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManager::FindingNetworkingSecurityGroups::VPCE::SG": "VPCEndpointSecurityGroup" } } }, { "Sid": "AllowSecurityGroupRuleUpdateWithTag", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group-rule/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingSecurityGroups::SG::Rule": "HTTPSAccess" } } }, { "Sid": "AllowSecurityGroupRuleUpdateTagRule", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group-rule/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingSecurityGroups::SG::Rule": "HTTPSAccess", "ec2:CreateAction": [ "AuthorizeSecurityGroupEgress", "AuthorizeSecurityGroupIngress" ] } } }, { "Sid": "AllowCreateSecurityGroupForVPCEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid": "AllowCreateSecurityGroupWithTag", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingSecurityGroups::VPCE::SG": "VPCEndpointSecurityGroup" } } }, { "Sid": "AllowTagCreationForSecurityGroupTags", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManager::FindingNetworkingSecurityGroups::VPCE::SG": "VPCEndpointSecurityGroup", "ec2:CreateAction": [ "CreateSecurityGroup" ] } } }, { "Sid": "AllowExecuteSSMAutomation", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:automation-definition/AWS-OrchestrateUnmanagedEC2Actions:*", "arn:aws:ssm:*:*:automation-definition/AWS-RemediateSSMAgent*:*" ] }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowPassRoleOnSelfToSsm", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-RemediationExecutionRole*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } } ] } } }, "createdDate": "2024-11-16T00:17:57.000Z", "lastUpdatedDate": "2024-11-16T00:17:57.000Z" }, "AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-16T00:25:12.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReadOnlyAccessOrganization", "Effect": "Allow", "Action": [ "organizations:ListRoots", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "AllowAssumeRemediationExecutionRoleWithinOrg", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/AWS-SSM-RemediationExecutionRole*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } } ] } } }, "createdDate": "2024-11-16T00:25:12.000Z", "lastUpdatedDate": "2024-11-16T00:25:12.000Z" }, "AWSPartnerCentralFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSPartnerCentralFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-18T23:33:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PassAWSPartnerCentralRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/PartnerCentralRoleFor*", "Condition": { "StringEquals": { "iam:PassedToService": "partnercentral-account-management.amazonaws.com" } } }, { "Sid": "PartnerUserRoleAssociation", "Effect": "Allow", "Action": [ "iam:ListRoles", "Partnercentral-account-management:AssociatePartnerUser", "Partnercentral-account-management:DisassociatePartnerUser" ], "Resource": "*" }, { "Sid": "AWSPartnerCentralAccess", "Effect": "Allow", "Action": [ "partnercentral:*" ], "Resource": "*", "Condition": { "StringEquals": { "partnercentral:Catalog": [ "AWS", "Sandbox" ] } } } ] } }, "v2": { "createdDate": "2024-11-18T23:33:28.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PassAWSPartnerCentralRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/PartnerCentralRoleFor*", "Condition": { "StringEquals": { "iam:PassedToService": "partnercentral-account-management.amazonaws.com" } } }, { "Sid": "PartnerUserRoleAssociation", "Effect": "Allow", "Action": [ "iam:ListRoles", "Partnercentral-account-management:AssociatePartnerUser", "Partnercentral-account-management:DisassociatePartnerUser" ], "Resource": "*" }, { "Sid": "AWSPartnerCentralAccess", "Effect": "Allow", "Action": [ "partnercentral:*" ], "Resource": "*", "Condition": { "StringEquals": { "partnercentral:Catalog": [ "AWS", "Sandbox" ] } } }, { "Sid": "PassAWSPartnerCentralSnapshotJobRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/*" ], "Condition": { "StringEquals": { "iam:PassedToService": "resource-snapshot-job.partnercentral-selling.amazonaws.com" } } } ] } } }, "createdDate": "2024-11-18T23:33:28.000Z", "lastUpdatedDate": "2024-12-10T18:21:17.000Z" }, "AWSMarketplaceSellerOfferManagement": { "arn": "arn:aws:iam::aws:policy/AWSMarketplaceSellerOfferManagement", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-19T00:41:38.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSMarketplaceChangeSetReadAccess", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeChangeSet", "aws-marketplace:ListChangeSets" ], "Resource": "*" }, { "Sid": "AWSMarketplaceOfferManagement", "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Offer/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ChangeSet/*" ] }, { "Sid": "AWSMarketplaceCreateOfferOnProduct", "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Resource": "*", "Condition": { "StringEquals": { "catalog:ChangeType": "CreateOfferOnProduct" } } }, { "Sid": "AWSMarketplaceListEntities", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities" ], "Resource": "*" }, { "Sid": "AWSMarketplaceEntitiesReadAccess", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Offer/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ContainerProduct/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ProfessionalServicesProduct/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/SaaSProduct/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/AmiProduct/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ResaleAuthorization/*" ] }, { "Sid": "AWSMarketplaceAgreementsReadAccess", "Effect": "Allow", "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms" ], "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } } ] } } }, "createdDate": "2024-11-19T00:41:38.000Z", "lastUpdatedDate": "2024-11-19T00:41:38.000Z" }, "SageMakerStudioProjectRoleMachineLearningPolicy": { "arn": "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountReadPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEqualsIfExists": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountReadPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEqualsIfExists": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v3": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerUpdateInferenceComponentRuntimeConfigAutoscalingPermissions", "Effect": "Allow", "Action": [ "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountReadPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEqualsIfExists": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v4": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerUpdateInferenceComponentRuntimeConfigAutoscalingPermissions", "Effect": "Allow", "Action": [ "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountReadPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEqualsIfExists": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } } ] } }, "v5": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerUpdateInferenceComponentRuntimeConfigAutoscalingPermissions", "Effect": "Allow", "Action": [ "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListHubs", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerListPermissionsTagRestricted", "Effect": "Allow", "Action": [ "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage", "sagemaker:ListModelPackages", "sagemaker:CreateModel" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "SageMakerKmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sagemaker.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v6": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission", "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerUpdateInferenceComponentRuntimeConfigAutoscalingPermissions", "Effect": "Allow", "Action": [ "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search", "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListHubs", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerListPermissionsTagRestricted", "Effect": "Allow", "Action": [ "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage", "sagemaker:ListModelPackages", "sagemaker:CreateModel" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "SageMakerKmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sagemaker.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v7": { "createdDate": "2024-11-20T21:55:27.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowManageSageMakerEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "sagemaker.amazonaws.com", "airflow.amazonaws.com" ] }, "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerTrainingEniOnVpc", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterfacePermission" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "AllowManageSageMakerEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpointOnVpcId", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}", "Condition": { "StringEquals": { "ec2:VpcID": "${aws:PrincipalTag/VpcId}" }, "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerCreateVpcEndpoint", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*" ], "Condition": { "StringEqualsIfExists": { "aws:CalledViaLast": "sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSageMakerDescribeVPCResources", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions" ], "Resource": "*" }, { "Sid": "AllowSageMakerLogAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerMlflowPermission", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerBYOFSPermissions", "Effect": "Allow", "Action": [ "elasticfilesystem:DescribeMountTargets" ], "Resource": "*" }, { "Sid": "SageMakerBYOIPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImageVersion", "sagemaker:ListImageVersions" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeImageActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeImage" ], "Resource": "arn:aws:sagemaker:*:*:image/*" }, { "Sid": "SageMakerPipelinesSTSPermissions", "Effect": "Allow", "Action": [ "sts:GetCallerIdentity" ], "Resource": "*" }, { "Sid": "SageMakerLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" }, { "Sid": "SageMakerCreatePermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateInferenceComponent", "sagemaker:CreatePipeline", "sagemaker:CreateInferenceRecommendationsJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerInferencePermissions", "Effect": "Allow", "Action": [ "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteInferenceComponent", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerUpdateInferenceComponentRuntimeConfigAutoscalingPermissions", "Effect": "Allow", "Action": [ "sagemaker:UpdateInferenceComponentRuntimeConfig" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "application-autoscaling.amazonaws.com", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerDescribeUpdateDeletePermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:UpdatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerModelRegistryLineageSpecialPermissions", "Effect": "Allow", "Action": [ "sagemaker:QueryLineage", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:GetSearchSuggestions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListHubs", "sagemaker:ListPipelines", "sagemaker:ListContexts" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerSearchPermissions", "Effect": "Allow", "Action": [ "sagemaker:Search" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true", "sagemaker:SearchVisibilityCondition/Tags.AmazonDataZoneProject/EqualsIfExists": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerListPermissionsTagRestricted", "Effect": "Allow", "Action": [ "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer" ], "Resource": "arn:aws:ecr:*:*:repository/*" }, { "Sid": "SageMakerECRGetAuthorizationTokenPermissions", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupGetPermission", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupListPermission", "Effect": "Allow", "Action": [ "resource-groups:ListGroupResources" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupWritePermission", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:Tag" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "AmazonSageMakerModelRegistryResourceGroupDeletePermission", "Effect": "Allow", "Action": [ "resource-groups:DeleteGroup" ], "Resource": "arn:aws:resource-groups:*:*:group/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerMLFlowModelRegistrationPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackageGroup" ], "Resource": "arn:aws:sagemaker:*:*:model-package-group/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioCreatePresignedDomainUrlForUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreatePresignedDomainUrl" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true" } } }, { "Sid": "SageMakerStudioAppListActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces" ], "Resource": "*" }, { "Sid": "SageMakerStudioAppDescribeDomainActionsPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioAppDescribeJupyterLabAppActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ] }, { "Sid": "SageMakerStudioAppDescribeUserProfileActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SMStudioAppDescribeSpaceActionPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeSpace" ], "Resource": "*" }, { "Sid": "SageMakerTagPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid": "SageMakerStudioAllowCreatingDeletingOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateSpace", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace" ], "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "SageMakerStudioRestrictPrivateSpaceAppsToOwnerUserProfile", "Effect": "Allow", "Action": [ "sagemaker:CreateApp", "sagemaker:DeleteApp" ], "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "sagemaker:SpaceSharingType": [ "Private" ] }, "ArnLike": { "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/*/${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "PublishSagemakerMetric", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "/aws/sagemaker/*" } } }, { "Sid": "ManageSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:DescribeAlarms" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MutateSageMakerEndpointsAutoscalingAlarms", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource": "arn:aws:cloudwatch:*:*:alarm:TargetTracking*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "application-autoscaling.amazonaws.com" } } }, { "Sid": "SSMPermissions", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" }, { "Sid": "SageMakerJumpstartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::jumpstart-cache-prod-*/*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerCrossAccountPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:BatchDescribeModelPackage", "sagemaker:ListModelPackages", "sagemaker:CreateModel" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerListTagsRestrictionOnSharedResources", "Effect": "Allow", "Action": [ "sagemaker:ListTags" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SageMakerAutoScalingPermissionsWithserviceNamespace", "Effect": "Allow", "Action": [ "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "application-autoscaling:service-namespace": "sagemaker" } } }, { "Sid": "SageMakerAutoScalingPermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions" ], "Resource": "arn:aws:application-autoscaling:*:*:scalable-target/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "SageMakerKmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sagemaker.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-20T21:55:27.000Z", "lastUpdatedDate": "2025-02-27T00:22:05.000Z" }, "SageMakerStudioDomainServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioDomainServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-20T21:56:22.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SSMGetParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles/*" ] }, { "Sid": "UseKMSKeyPermissionsStatement", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "true" }, "Null": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "false" }, "StringLike": { "kms:ViaService": "ssm.*.amazonaws.com", "kms:EncryptionContext:PARAMETER_ARN": "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" } } } ] } } }, "createdDate": "2024-11-20T21:56:22.000Z", "lastUpdatedDate": "2024-11-20T21:56:22.000Z" }, "SageMakerStudioDomainExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioDomainExecutionRolePolicy", "latestVersionId": "v3", "versionsCount": 3, "versions": { "v1": { "createdDate": "2024-11-20T21:56:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateConnection", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteConnection", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetConnection", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListConnections", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateConnection", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "AmazonQPermissionsStatement", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:PassRequest", "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "SSMGetParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codestar-connections:ListConnections", "codestar-connections:ListTagsForResource" ], "Resource": "*" }, { "Sid": "UseCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UseConnection", "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/for-use-with-all-datazone-projects": "false" }, "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "ProjectProfilePermissionsStatement", "Effect": "Allow", "Action": [ "datazone:GetProjectProfile", "datazone:ListProjectProfiles" ], "Resource": "arn:aws:datazone:*:*:domain/*" } ] } }, "v2": { "createdDate": "2024-11-20T21:56:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateConnection", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteConnection", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetConnection", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListConnections", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateConnection", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "AmazonQPermissionsStatement", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:PassRequest", "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "SSMGetParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:GetConnection", "codeconnections:GetHost", "codestar-connections:GetConnection", "codestar-connections:GetHost" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/for-use-with-all-datazone-projects": "false" }, "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "ListCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codestar-connections:ListConnections", "codestar-connections:ListTagsForResource" ], "Resource": "*" }, { "Sid": "UseCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UseConnection", "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/for-use-with-all-datazone-projects": "false" }, "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "ProjectProfilePermissionsStatement", "Effect": "Allow", "Action": [ "datazone:GetProjectProfile", "datazone:ListProjectProfiles" ], "Resource": "arn:aws:datazone:*:*:domain/*" } ] } }, "v3": { "createdDate": "2024-11-20T21:56:55.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:AcceptPredictions", "datazone:AcceptSubscriptionRequest", "datazone:AddEntityOwner", "datazone:AddPolicyGrant", "datazone:CancelMetadataGenerationRun", "datazone:CancelSubscription", "datazone:CreateAsset", "datazone:CreateAssetFilter", "datazone:CreateAssetRevision", "datazone:CreateAssetType", "datazone:CreateConnection", "datazone:CreateDataProduct", "datazone:CreateDataProductRevision", "datazone:CreateDataSource", "datazone:CreateDomainUnit", "datazone:CreateEnvironment", "datazone:CreateEnvironmentProfile", "datazone:CreateFormType", "datazone:CreateGlossary", "datazone:CreateGlossaryTerm", "datazone:CreateListingChangeSet", "datazone:CreateProject", "datazone:CreateProjectMembership", "datazone:CreateRule", "datazone:CreateSubscriptionGrant", "datazone:CreateSubscriptionRequest", "datazone:DeleteAsset", "datazone:DeleteAssetFilter", "datazone:DeleteAssetType", "datazone:DeleteConnection", "datazone:DeleteDataProduct", "datazone:DeleteDataSource", "datazone:DeleteDomainUnit", "datazone:DeleteEnvironment", "datazone:DeleteEnvironmentProfile", "datazone:DeleteFormType", "datazone:DeleteGlossary", "datazone:DeleteGlossaryTerm", "datazone:DeleteListing", "datazone:DeleteProject", "datazone:DeleteProjectMembership", "datazone:DeleteRule", "datazone:DeleteSubscriptionGrant", "datazone:DeleteSubscriptionRequest", "datazone:DeleteSubscriptionTarget", "datazone:DeleteTimeSeriesDataPoints", "datazone:GetAsset", "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetConnection", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentActionLink", "datazone:GetEnvironmentBlueprint", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentCredentials", "datazone:GetEnvironmentProfile", "datazone:GetFormType", "datazone:GetGlossary", "datazone:GetGlossaryTerm", "datazone:GetGroupProfile", "datazone:GetLineageNode", "datazone:GetListing", "datazone:GetMetadataGenerationRun", "datazone:GetProject", "datazone:GetRule", "datazone:GetSubscription", "datazone:GetSubscriptionEligibility", "datazone:GetSubscriptionGrant", "datazone:GetSubscriptionRequestDetails", "datazone:GetSubscriptionTarget", "datazone:GetTimeSeriesDataPoint", "datazone:GetUpdateEligibility", "datazone:GetUserProfile", "datazone:ListAccountEnvironments", "datazone:ListAssetFilters", "datazone:ListAssetRevisions", "datazone:ListConnections", "datazone:ListDataProductRevisions", "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurationSummaries", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListGroupsForUser", "datazone:ListLineageNodeHistory", "datazone:ListMetadataGenerationRuns", "datazone:ListNotifications", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjects", "datazone:ListRules", "datazone:ListSubscriptionGrants", "datazone:ListSubscriptionRequests", "datazone:ListSubscriptionTargets", "datazone:ListSubscriptions", "datazone:ListTimeSeriesDataPoints", "datazone:ListWarehouseMetadata", "datazone:RejectPredictions", "datazone:RejectSubscriptionRequest", "datazone:RemoveEntityOwner", "datazone:RemovePolicyGrant", "datazone:RevokeSubscription", "datazone:Search", "datazone:SearchGroupProfiles", "datazone:SearchListings", "datazone:SearchRules", "datazone:SearchTypes", "datazone:SearchUserProfiles", "datazone:StartDataSourceRun", "datazone:StartMetadataGenerationRun", "datazone:UpdateAssetFilter", "datazone:UpdateConnection", "datazone:UpdateDataSource", "datazone:UpdateDomainUnit", "datazone:UpdateEnvironment", "datazone:UpdateEnvironmentDeploymentStatus", "datazone:UpdateEnvironmentProfile", "datazone:UpdateGlossary", "datazone:UpdateGlossaryTerm", "datazone:UpdateProject", "datazone:UpdateRule", "datazone:UpdateSubscriptionGrantStatus", "datazone:UpdateSubscriptionRequest" ], "Resource": "*" }, { "Sid": "RAMResourceShareStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShareAssociations", "ram:GetResourceShares" ], "Resource": "*" }, { "Sid": "AmazonQPermissionsStatement", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:ListConversations", "q:GetConversation", "q:PassRequest", "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "SSMGetParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:GetConnection", "codeconnections:GetHost", "codestar-connections:GetConnection", "codestar-connections:GetHost" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/for-use-with-all-datazone-projects": "false" }, "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "ListCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codestar-connections:ListConnections", "codestar-connections:ListTagsForResource" ], "Resource": "*" }, { "Sid": "UseCodeConnectionsPermissionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UseConnection", "codestar-connections:UseConnection" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/for-use-with-all-datazone-projects": "false" }, "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "ProjectProfilePermissionsStatement", "Effect": "Allow", "Action": [ "datazone:GetProjectProfile", "datazone:ListProjectProfiles" ], "Resource": "arn:aws:datazone:*:*:domain/*" } ] } } }, "createdDate": "2024-11-20T21:56:55.000Z", "lastUpdatedDate": "2025-03-26T18:52:05.000Z" }, "SageMakerStudioProjectUserRolePermissionsBoundary": { "arn": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary", "latestVersionId": "v7", "versionsCount": 7, "versions": { "v1": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "glue.amazonaws.com" ] } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessForFederatedDataConnection", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:DescribeCluster", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "tag:GetResources" ], "Resource": "*" } ] } }, "v2": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessForFederatedDataConnection", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:ListTables", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } }, "v3": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*", "arn:*:glue:*:*:catalog/*", "arn:*:glue:*:*:database/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessCertificateS3LocationPermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessForFederatedDataConnection", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:ListTables", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } }, "v4": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*", "arn:*:glue:*:*:catalog/*", "arn:*:glue:*:*:database/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "DataZoneKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "DataZoneDescribeKMSPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessCertificateS3LocationPermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode", "glue:GetTags" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "ListDomainS3BucketForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:ListTables", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStagingBucketLocation", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetManagedWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } }, "v5": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*", "arn:*:glue:*:*:catalog/*", "arn:*:glue:*:*:database/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "DataZoneKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "DataZoneDescribeKMSPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessCertificateS3LocationPermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode", "glue:GetTags" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockKnowledgeBaseDataIngestionKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/AmazonBedrockManaged": "true" }, "Null": { "kms:ViaService": "true", "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "ListDomainS3BucketForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3PermissionsForAthenaCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::redshift-staging-bucket-*/*", "arn:aws:s3:::redshift-staging-bucket-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetS3ObjectForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*/dzd_*/*/dev/sys/athena/*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:Scan", "dynamodb:Query", "dynamodb:DescribeBackup", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeEndpoints", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeImport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListImports", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PutItem", "dynamodb:PartiQLSelect", "dynamodb:PartiQLInsert", "dynamodb:PartiQLUpdate", "dynamodb:PartiQLDelete", "dynamodb:UpdateItem", "dynamodb:UpdateGlobalTable", "dynamodb:UpdateTable", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStagingBucketLocation", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetManagedWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } }, "v6": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*", "arn:*:glue:*:*:catalog/*", "arn:*:glue:*:*:database/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "DataZoneKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "DataZoneDescribeKMSPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessCertificateS3LocationPermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode", "glue:GetTags" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModel", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockKnowledgeBaseDataIngestionKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/AmazonBedrockManaged": "true" }, "Null": { "kms:ViaService": "true", "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "ListDomainS3BucketForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3PermissionsForAthenaCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::redshift-staging-bucket-*/*", "arn:aws:s3:::redshift-staging-bucket-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetS3ObjectForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*/dzd_*/*/dev/sys/athena/*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:Scan", "dynamodb:Query", "dynamodb:DescribeBackup", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeEndpoints", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeImport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListImports", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PutItem", "dynamodb:PartiQLSelect", "dynamodb:PartiQLInsert", "dynamodb:PartiQLUpdate", "dynamodb:PartiQLDelete", "dynamodb:UpdateItem", "dynamodb:UpdateGlobalTable", "dynamodb:UpdateTable", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStagingBucketLocation", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetManagedWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } }, "v7": { "createdDate": "2024-11-20T21:57:42.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllNonMatchingProjectTag", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:*:sagemaker:*:*:model-package-group/*", "arn:*:sagemaker:*:*:model-package/*", "arn:*:glue:*:*:catalog/*", "arn:*:glue:*:*:database/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/AmazonDataZoneProject": "false", "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" }, "StringNotEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "redshift-serverless.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com", "ec2.*.amazonaws.com", "codecommit.*.amazonaws.com", "glue.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AllowGenerateDataKeyForEmrEbsEncryption", "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SameAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "bedrock.*.amazonaws.com", "secretsmanager.*.amazonaws.com", "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:AbortMultipartUpload" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "CrossAccountKMSManagementPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListGrants", "kms:GetPublicKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] } } }, { "Sid": "DataZoneKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "*" ], "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "DataZoneDescribeKMSPermissions", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "datazone.*.amazonaws.com" ] } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessCertificateS3LocationPermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "CloudWatchDescribeLogGroups", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", "logs:StartQuery", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/*", "arn:aws:logs:*:*:log-group:airflow*", "arn:aws:logs:*:*:log-group:datazone*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "AthenaPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "AthenaPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataZonePermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "*" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": "*" }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "GlueUnrestrictedPermissions", "Effect": "Allow", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:GetConnection", "glue:GetConnections", "glue:GetDatabase", "glue:GetDatabases", "glue:UseGlueStudio", "glue:ListSessions", "glue:StartCompletion", "glue:GetCompletion", "glue:GetGeneratedCode", "glue:GetTags" ], "Resource": "*" }, { "Sid": "GluePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetSession", "glue:GetStatement", "glue:CancelStatement", "glue:ListStatements", "glue:TagResource", "glue:UntagResource", "glue:DeleteSession", "glue:RunStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "glue.amazonaws.com", "sagemaker.amazonaws.com", "ec2.amazonaws.com", "emr-serverless.amazonaws.com" ] } } }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftUnrestrictedPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "tag:GetResources" ], "Resource": "*" }, { "Sid": "RedshiftPermissionsWithResourceTag", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "GenerativeAIPermissions", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:*-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "ManageNetworkPermissions", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeNetworkInterfaces", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DeleteNetworkInterface", "ec2:DetachNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeleteTags" ], "Resource": "*" }, { "Sid": "SageMakerPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListImageVersions", "sagemaker:ListTrainingJobs", "sagemaker:ListTransformJobs", "sagemaker:ListProcessingJobs", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListInferenceComponents", "sagemaker:ListEndpoints", "sagemaker:ListEndpointConfigs", "sagemaker:ListModels", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListApps", "sagemaker:ListDomains", "sagemaker:ListUserProfiles", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeImageVersion", "sagemaker:DescribeImage", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeModel", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineExecution", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeApp", "sagemaker:DescribeUserProfile", "sagemaker:DescribeSpace", "sagemaker:AddTags", "sagemaker:AddAssociation", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteAction", "sagemaker:DeleteArtifact", "sagemaker:DeleteUserProfile", "sagemaker:UpdateSpace", "sagemaker:DeleteSpace", "sagemaker:DeleteApp", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:CreateSpace", "sagemaker:CreateApp", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateProcessingJob", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateEndpointConfig", "sagemaker:CreateEndpoint", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePipeline", "sagemaker:CreateContext", "sagemaker:CreateArtifact", "sagemaker:CreateAction", "sagemaker:CreateInferenceComponent", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:StopTrainingJob", "sagemaker:StopProcessingJob", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:UpdateTrainingJob", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteEndpoint", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:BatchDescribeModelPackage", "sagemaker:UpdateModelPackage", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteTags", "sagemaker:DeleteInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:QueryLineage", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:StartPipelineExecution", "sagemaker:StopPipelineExecution", "sagemaker:RetryPipelineExecution", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:GetSearchSuggestions", "sagemaker:Search", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:StartMlflowTrackingServer", "sagemaker:StopMlflowTrackingServer", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:ListPartnerApps", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:GetModelVersionByAlias", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages", "elasticfilesystem:DescribeMountTargets", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "SageMakerSLRForAutoScalingPermissions", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "Condition": { "StringLike": { "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" } } }, { "Sid": "ComputePermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricData", "sts:GetCallerIdentity", "sts:TagSession", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetPersistentAppUIPresignedURL", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "ComputePermissionsWithResourceTag", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "DataLakePermissions", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "CodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServicePermissions", "Effect": "Allow", "Action": [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScheduledAction", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeletePlacementGroup", "ec2:ModifyInstanceAttribute", "ec2:TerminateInstances", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribePlacementGroups", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "resource-groups:ListGroupResources" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupGetPermissions", "Effect": "Allow", "Action": [ "resource-groups:GetGroupQuery" ], "Resource": "*" }, { "Sid": "ModelRegistryResourceGroupMutatePermissions", "Effect": "Allow", "Action": [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:Tag" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:collection": "false" } } }, { "Sid": "ModelRegistryBedRockPermissions", "Effect": "Allow", "Action": [ "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "AccessAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "*" }, { "Sid": "AccessBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:InvokeAgent", "bedrock:ListAgentActionGroups", "bedrock:ListAgentKnowledgeBases", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModel", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*" }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockKnowledgeBaseDataIngestionKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/AmazonBedrockManaged": "true" }, "Null": { "kms:ViaService": "true", "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetDataZoneEnvironmentCfnStackPermissionsForBedrockAppExport", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "MWAAPermissions", "Effect": "Allow", "Action": [ "airflow:ListEnvironments", "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": "*" }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "SQSPermissionsForMWAA", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:*:airflow-celery-*" }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueConnectionAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "SecretAccessForForUseWithAllDataZoneProjectsSecrets", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AccessForDynamoDbConnections", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceTag/federated_athena_datacatalog": "true" } } }, { "Sid": "ListDomainS3BucketForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3PermissionsForAthenaCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::redshift-staging-bucket-*/*", "arn:aws:s3:::redshift-staging-bucket-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetS3ObjectForQueryExecutionRolePermissions", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::*/dzd_*/*/dev/sys/athena/*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "NotDeniedOperations", "Effect": "Deny", "NotAction": [ "airflow:CreateWebLoginToken", "airflow:GetEnvironment", "airflow:InvokeRestApi", "airflow:ListEnvironments", "airflow:UpdateEnvironment", "aoss:APIAccessAll", "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeleteScheduledAction", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:DescribeScheduledActions", "application-autoscaling:PutScalingPolicy", "application-autoscaling:PutScheduledAction", "application-autoscaling:RegisterScalableTarget", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetTableMetadata", "athena:GetWorkGroup", "athena:ImportNotebook", "athena:ListDatabases", "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListNamedQueries", "athena:ListPreparedStatements", "athena:ListQueryExecutions", "athena:ListTableMetadata", "athena:ListTagsForResource", "athena:ListWorkGroups", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement", "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetInferenceProfile", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListEvaluationJobs", "bedrock:ListFoundationModels", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:TagResource", "bedrock:UpdateAgentAlias", "cloudformation:DescribeStacks", "cloudformation:GetTemplate", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:PutMetricData", "codecommit:BatchDescribeMergeConflicts", "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codewhisperer:GenerateRecommendations", "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironmentBlueprints", "datazone:ListEnvironments", "datazone:ListProjects", "datazone:UpdateConnection", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:Scan", "dynamodb:Query", "dynamodb:DescribeBackup", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeEndpoints", "dynamodb:DescribeExport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeImport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListImports", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PutItem", "dynamodb:PartiQLSelect", "dynamodb:PartiQLInsert", "dynamodb:PartiQLUpdate", "dynamodb:PartiQLDelete", "dynamodb:UpdateItem", "dynamodb:UpdateGlobalTable", "dynamodb:UpdateTable", "ec2:AttachNetworkInterface", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:CreatePlacementGroup", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DeletePlacementGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeCapacityReservations", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyInstanceAttribute", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances", "ec2:TerminateInstances", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeMountTargets", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribeCluster", "elasticmapreduce:DescribePersistentAppUI", "elasticmapreduce:GetClusterSessionCredentials", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL", "elasticmapreduce:GetPersistentAppUIPresignedURL", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:TerminateJobFlows", "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun", "emr-serverless:ListApplications", "emr-serverless:ListJobRunAttempts", "emr-serverless:ListJobRuns", "emr-serverless:StartApplication", "emr-serverless:StartJobRun", "emr-serverless:StopApplication", "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:BatchStopJobRun", "glue:BatchUpdatePartition", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:CancelStatement", "glue:CreateBlueprint", "glue:CreateDatabase", "glue:CreateDataQualityRuleset", "glue:CreateJob", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateSession", "glue:CreateTable", "glue:CreateWorkflow", "glue:DeleteBlueprint", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeleteDatabase", "glue:DeleteDataQualityRuleset", "glue:DeleteJob", "glue:DeletePartition", "glue:DeletePartitionIndex", "glue:DeleteSession", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:DeleteWorkflow", "glue:DescribeConnectionType", "glue:DescribeEntity", "glue:GetCatalog", "glue:GetCatalogImportStatus", "glue:GetCatalogs", "glue:GetClassifier", "glue:GetClassifiers", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCompletion", "glue:GetConnection", "glue:GetConnections", "glue:GetDashboardUrl", "glue:GetDatabase", "glue:GetDatabases", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:GetEntityRecords", "glue:GetGeneratedCode", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetSession", "glue:GetStatement", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTags", "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions", "glue:ListConnectionTypes", "glue:ListCrawls", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:ListEntities", "glue:ListSessions", "glue:ListStatements", "glue:ListTableOptimizerRuns", "glue:NotifyEvent", "glue:PassConnection", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:PutWorkflowRunProperties", "glue:ResumeWorkflowRun", "glue:RunStatement", "glue:SearchTables", "glue:StartBlueprintRun", "glue:StartCompletion", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:StartJobRun", "glue:StartWorkflowRun", "glue:StopSession", "glue:StopWorkflowRun", "glue:TagResource", "glue:UntagResource", "glue:UpdateBlueprint", "glue:UpdateCatalog", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:UpdateDataQualityRuleset", "glue:UpdateJob", "glue:UpdatePartition", "glue:UpdateTable", "glue:UpdateWorkflow", "glue:UseGlueStudio", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListRoles", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:RevokeGrant", "lakeformation:GetDataAccess", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetLogRecord", "logs:GetQueryResults", "logs:PutLogEvents", "logs:StartQuery", "logs:StopQuery", "pricing:GetProducts", "q:SendMessage", "q:StartConversation", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:DescribeTable", "redshift-data:ExecuteStatement", "redshift-data:GetStagingBucketLocation", "redshift-data:GetStatementResult", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListStatements", "redshift-data:ListTables", "redshift-serverless:GetCredentials", "redshift-serverless:GetManagedWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "resource-groups:CreateGroup", "resource-groups:DeleteGroup", "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources", "resource-groups:Tag", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:GetObject*", "s3:ListBucket", "s3:ListBucketVersions", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:ReplicateObject", "s3:RestoreObject", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateModelVersion", "sagemaker-mlflow:CreateRegisteredModel", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:DeleteExperiment", "sagemaker-mlflow:DeleteModelVersion", "sagemaker-mlflow:DeleteModelVersionTag", "sagemaker-mlflow:DeleteRegisteredModel", "sagemaker-mlflow:DeleteRegisteredModelAlias", "sagemaker-mlflow:DeleteRegisteredModelTag", "sagemaker-mlflow:DeleteRun", "sagemaker-mlflow:DeleteTag", "sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetLatestModelVersions", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetModelVersion", "sagemaker-mlflow:GetModelVersionByAlias", "sagemaker-mlflow:GetRegisteredModel", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:RenameRegisteredModel", "sagemaker-mlflow:RestoreExperiment", "sagemaker-mlflow:RestoreRun", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchModelVersions", "sagemaker-mlflow:SearchRegisteredModels", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:SetExperimentTag", "sagemaker-mlflow:SetRegisteredModelAlias", "sagemaker-mlflow:SetRegisteredModelTag", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:TransitionModelVersionStage", "sagemaker-mlflow:UpdateExperiment", "sagemaker-mlflow:UpdateModelVersion", "sagemaker-mlflow:UpdateRegisteredModel", "sagemaker-mlflow:UpdateRun", "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchPutMetrics", "sagemaker:CallPartnerAppApi", "sagemaker:CreateAction", "sagemaker:CreateApp", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateAutoMLJobV2", "sagemaker:CreateContext", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateInferenceComponent", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedMlflowTrackingServerUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateSpace", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateUserProfile", "sagemaker:DeleteAction", "sagemaker:DeleteApp", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteContext", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeletePipeline", "sagemaker:DeleteSpace", "sagemaker:DeleteTags", "sagemaker:DeleteUserProfile", "sagemaker:DescribeAction", "sagemaker:DescribeApp", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeContext", "sagemaker:DescribeDomain", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeSpace", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListContexts", "sagemaker:ListDomains", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListHubContents", "sagemaker:ListHubs", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModels", "sagemaker:ListPartnerApps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListSpaces", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListUserProfiles", "sagemaker:QueryLineage", "sagemaker:RetryPipelineExecution", "sagemaker:Search", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartMlflowTrackingServer", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopMlflowTrackingServer", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateInferenceComponentRuntimeConfig", "sagemaker:UpdateMlflowTrackingServer", "sagemaker:UpdateModelPackage", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateSpace", "sagemaker:UpdateTrainingJob", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:ListSecrets", "secretsmanager:PutSecretValue", "sqlworkbench:CreateConnection", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:GetQCustomContext", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:GetUserInfo", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:ListTabs", "sqlworkbench:PassAccountSettings", "sqlworkbench:PutQCustomContext", "sqlworkbench:PutTab", "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "sts:AssumeRole", "sts:GetCallerIdentity", "sts:SetSourceIdentity", "sts:TagSession", "tag:GetResources" ], "Resource": "*" } ] } } }, "createdDate": "2024-11-20T21:57:42.000Z", "lastUpdatedDate": "2025-01-03T00:37:06.000Z" }, "SageMakerStudioProjectProvisioningRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioProjectProvisioningRolePolicy", "latestVersionId": "v12", "versionsCount": 12, "versions": { "v1": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": "codecommit:DeleteRepository", "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": "arn:aws:iam::*:policy/datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/BedrockStudio*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassConnectorRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/ConnectorManageAccessRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*", "aoss:index": "amazon-bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AirflowKmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": "codecommit:DeleteRepository", "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "CreatedForUseWithSageMakerStudio" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/BedrockStudio*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassConnectorRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/ConnectorManageAccessRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*", "aoss:index": "amazon-bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AirflowKmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v3": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": "codecommit:DeleteRepository", "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/BedrockStudio*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassConnectorRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/ConnectorManageAccessRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*", "aoss:index": "amazon-bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "amazon-bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AirflowKmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v4": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": "codecommit:DeleteRepository", "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AirflowKmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } } ] } }, "v5": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": "codecommit:DeleteRepository", "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AirflowKmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } } ] } }, "v6": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } } ] } }, "v7": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEChatAppUserRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonBedrockIDEEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteDomain", "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v8": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "DataSourcePath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId", "VpcId" ] } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainUpdationAndDeletion", "Effect": "Allow", "Action": [ "sagemaker:UpdateDomain", "sagemaker:DeleteDomain" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:UpdateApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerlessSharedVPC", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:UpdateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupCleanUpForEMR", "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListInstanceProfilesForRole", "iam:DeleteRolePolicy", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMInstanceProfileCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamGetEmrRoleFromDataZone", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } } ] } }, "v9": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockPermissions", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "DataSourcePath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId", "VpcId" ] } } }, { "Sid": "IAMRoleUntagging", "Effect": "Allow", "Action": "iam:UntagRole", "Resource": "arn:aws:iam::*:role/datazone_usr_role_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": "EnableAmazonBedrockIDEPermissions" } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainUpdationAndDeletion", "Effect": "Allow", "Action": [ "sagemaker:UpdateDomain", "sagemaker:DeleteDomain" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:GetApplication", "emr-serverless:UpdateApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerlessSharedVPC", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:UpdateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupCleanUpForEMR", "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListInstanceProfilesForRole", "iam:DeleteRolePolicy", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMInstanceProfileCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamGetEmrRoleFromDataZone", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } } ] } }, "v10": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockPermissions", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "DataSourcePath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId", "VpcId" ] } } }, { "Sid": "IAMRoleUntagging", "Effect": "Allow", "Action": "iam:UntagRole", "Resource": "arn:aws:iam::*:role/datazone_usr_role_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": "EnableAmazonBedrockIDEPermissions" } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainUpdationAndDeletion", "Effect": "Allow", "Action": [ "sagemaker:UpdateDomain", "sagemaker:DeleteDomain" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessGetApplication", "Effect": "Allow", "Action": "emr-serverless:GetApplication", "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerlessSharedVPC", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:UpdateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupCleanUpForEMR", "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListInstanceProfilesForRole", "iam:DeleteRolePolicy", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMInstanceProfileCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamGetEmrRoleFromDataZone", "Effect": "Allow", "Action": "iam:GetRole", "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } } ] } }, "v11": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", "arn:aws:iam::aws:policy/AmazonSageMakerPartnerAppsFullAccess" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockPermissions", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "DataSourcePath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId", "VpcId" ] } } }, { "Sid": "IAMRoleUntagging", "Effect": "Allow", "Action": "iam:UntagRole", "Resource": "arn:aws:iam::*:role/datazone_usr_role_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": "EnableAmazonBedrockIDEPermissions" } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone_emr_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainUpdationAndDeletion", "Effect": "Allow", "Action": [ "sagemaker:UpdateDomain", "sagemaker:DeleteDomain" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessGetApplication", "Effect": "Allow", "Action": "emr-serverless:GetApplication", "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerlessSharedVPC", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:UpdateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupCleanUpForEMR", "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListInstanceProfilesForRole", "iam:DeleteRolePolicy", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMInstanceProfileCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v12": { "createdDate": "2024-11-20T21:58:39.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudFormationStackCreationAndTagging", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CloudFormationStackManagement", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CloudFormationStackDeletion", "Effect": "Allow", "Action": [ "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudFormationListStacks", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LakeFormationPermissionsForDataLakeValidation", "Effect": "Allow", "Action": [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions" ], "Resource": "*" }, { "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", "Effect": "Allow", "Action": [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions", "lakeformation:ListResources" ], "Resource": "*" }, { "Sid": "PermissionsToGetBlueprintTemplates", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "CodeCommitCreationAndTagging", "Effect": "Allow", "Action": [ "codecommit:CreateRepository", "codecommit:TagResource" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "CodeCommitDeletion", "Effect": "Allow", "Action": [ "codecommit:DeleteRepository", "codecommit:UpdateRepositoryEncryptionKey", "codecommit:PutRepositoryTriggers" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CodeCommitAccess", "Effect": "Allow", "Action": [ "codecommit:GetBranch", "codecommit:CreateCommit", "codecommit:GetRepository", "codecommit:GetFile" ], "Resource": "arn:aws:codecommit:*:*:datazone*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CodeCommitListRepositories", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:ReEncryptTo", "kms:ReEncryptFrom", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "GetIAMRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMRoleAndPolicyManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrockExecution*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/AmazonBedrockConsumptionRole*", "arn:aws:iam::*:role/AmazonBedrockEvaluation*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleAndPolicyManagementFromDataZone", "Effect": "Allow", "Action": [ "iam:DeleteRolePolicy", "iam:PutRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCreation", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", "arn:aws:iam::aws:policy/AmazonSageMakerPartnerAppsFullAccess" ] } } }, { "Sid": "IAMRoleManagementForBedrock", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy" ] } } }, { "Sid": "IAMRoleTagging", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/datazone_redshift_serverless_admin_role_*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "RedshiftDb*", "EnableAmazonBedrockPermissions", "EnableAmazonBedrockIDEPermissions", "EnableGlueWorkloadsPermissions", "EnableSageMakerMLWorkloadsPermissions", "DomainBucketName", "KmsKeyId", "LogGroupName", "RoleName", "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IAMRoleTaggingForBedrock", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/AmazonBedrock*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "DomainBucketName", "KmsKeyId", "AgentId", "AgentAliasId", "AppDefinitionPath", "DataSourcePath", "PromptId", "PromptVersion", "PromptDefinitionPath", "OpenSearchServerlessCollectionId" ] } } }, { "Sid": "IAMRoleTaggingForRedshift", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "RedshiftDb*" ] } } }, { "Sid": "IAMRoleTaggingForEmr", "Effect": "Allow", "Action": "iam:TagRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*", "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "DataZone*", "for-use-with-amazon-emr-managed-policies", "DomainBucketName", "KmsKeyId", "VpcId" ] } } }, { "Sid": "IAMRoleUntagging", "Effect": "Allow", "Action": "iam:UntagRole", "Resource": "arn:aws:iam::*:role/datazone_usr_role_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": "EnableAmazonBedrockIDEPermissions" } } }, { "Sid": "IamManageRoles", "Effect": "Allow", "Action": [ "iam:DeleteRole", "iam:ListRolePolicies", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/datazone*", "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamManageRolesFromDataZone", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:UpdateAssumeRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/datazone_emr_*", "arn:aws:iam::*:role/datazone-partner-apps-*", "arn:aws:iam::*:role/AmazonBedrock*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IamAttachPolicyFromService", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamDetachPolicyFromService", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/datazone*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementFromService", "Effect": "Allow", "Action": [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:CreatePolicyVersion", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource": [ "arn:aws:iam::*:policy/datazone*", "arn:aws:iam::*:policy/connector-manage-access-policy*", "arn:aws:iam::*:policy/SageMakerStudioQueryExecutionRolePolicy" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IAMPolicyManagementWithoutRequiredResources", "Effect": "Allow", "Action": [ "iam:ListPolicies" ], "Resource": "*" }, { "Sid": "GlueConnectionTypeUnrestrictedAccess", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "IAMInstanceProfileManagement", "Effect": "Allow", "Action": [ "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com", "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com", "redshift-serverless.amazonaws.com", "redshift.amazonaws.com", "emr-serverless.amazonaws.com", "airflow.amazonaws.com" ] } } }, { "Sid": "IamPassRoleFromDataZone", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "redshift-serverless.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForGlueCatalog", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*", "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrServiceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_service_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "elasticmapreduce.amazonaws.com" ] } } }, { "Sid": "IamPassRoleForEmrInstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "ec2.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrock", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "IamPassRoleToLambda", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrock*", "arn:aws:iam::*:role/BedrockStudio*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Sid": "IamCreateServiceLinkedRoleForAoss", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "GlueDefaultDatabaseCreation", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseCreationFromCloudFormation", "Effect": "Allow", "Action": [ "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGetDatabaseForTagging", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueDatabaseDeletion", "Effect": "Allow", "Action": [ "glue:DeleteDatabase" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagGlueResources", "Effect": "Allow", "Action": [ "glue:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "GetGlueConnectionToAllowTagging", "Effect": "Allow", "Action": "glue:GetConnection", "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueConnectionCreateAndDelete", "Effect": "Allow", "Action": [ "glue:CreateConnection", "glue:DeleteConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/datazone-glue-network-connection-*", "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDataGlueConnectionPermissions", "Action": [ "glue:PassConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ], "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataAthenaConnectionPermissions", "Action": [ "athena:CreateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Effect": "Allow", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataGetConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "FederatedDataConnectionTaggingPermissions", "Effect": "Allow", "Action": [ "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "federated_athena*" ] } } }, { "Sid": "FederatedDataConnectionGlueCreateConnection", "Effect": "Allow", "Action": [ "glue:CreateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnection", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:connection/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDataConnectionGlueManageConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:DeleteConnection", "glue:UpdateConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaServerlessPermission", "Effect": "Allow", "Action": [ "serverlessrepo:GetCloudFormationTemplate", "serverlessrepo:CreateCloudFormationTemplate" ], "Resource": [ "arn:aws:serverlessrepo:*:*:applications/Athena*" ] }, { "Sid": "FederatedDBECRPermission", "Effect": "Allow", "Action": [ "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:*:*:repository/athena-federation-repository*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "lambda.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaCFNPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet" ], "Resource": [ "arn:aws:cloudformation:*:*:transform/Serverless*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "cloudformation.amazonaws.com" } } }, { "Sid": "FederatedDBAthenaLambdaPermission", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaGetFunctionLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": [ "athena.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "FederatedDBAthenaUpdateLambdaPermission", "Effect": "Allow", "Action": [ "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "FederatedDBAthenaLambdaTaggingPermission", "Effect": "Allow", "Action": [ "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:athenafederatedcatalog*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:CalledViaLast": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "aws:cloudformation:*", "federated_athena*", "lambda:createdBy" ] } } }, { "Sid": "FederatedDBAthenaS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::awsserverlessrepo*" ], "Condition": { "StringLike": { "aws:CalledViaLast": [ "lambda.amazonaws.com" ] } } }, { "Sid": "FederatedDBGlueS3Permission", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": [ "glue.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "s3:prefix": "true" } } }, { "Sid": "FederatedDBAthenaCommonPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource": "arn:aws:cloudformation:*:*:stack/athenafederatedcatalog*", "Condition": { "Null": { "aws:ResourceTag/federated_athena_datacatalog": "false" } } }, { "Sid": "DataCatalogAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "athena:DeleteDataCatalog", "athena:GetDataCatalog", "athena:UpdateDataCatalog" ], "Resource": "arn:aws:athena:*:*:datacatalog/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamPassProjectRoleToLambdaForFederatedDataConnection", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/datazone_usr_role_*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "lambda.amazonaws.com" ] } } }, { "Sid": "IamGetRoleProvisioningRoleForFederatedDataConnection", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Effect": "Allow" }, { "Sid": "GlueCatalogCreation", "Effect": "Allow", "Action": [ "glue:CreateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GlueCatalogManagement", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetCatalogs", "glue:UpdateCatalog", "glue:DeleteCatalog", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftPermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:DeleteNamespace", "redshift-serverless:DeleteWorkgroup", "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftDataSharePermissionsForGlueCatalogs", "Effect": "Allow", "Action": [ "redshift:AssociateDataShareConsumer", "redshift:AuthorizeDataShare" ], "Resource": [ "arn:aws:redshift:*:*:datashare:*/*" ], "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "redshift-serverless.amazonaws.com", "glue.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedShiftStagingBucketCreation", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource": "arn:aws:s3:::redshift-staging-bucket-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessTaggingForGlueCatalog", "Effect": "Allow", "Action": [ "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "SecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "SecurityGroupAuthorize", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SecurityGroupManagement", "Effect": "Allow", "Action": [ "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SecurityGroupIngressRevokeForEMR", "Effect": "Allow", "Action": [ "ec2:RevokeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EC2ResourceTagging", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } } }, { "Sid": "DescribeNetworksPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSubnets" ], "Resource": "*" }, { "Sid": "DescribeLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "LogGroupCreation", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged" ] } } }, { "Sid": "LogGroupPutRetentionPolicy", "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageLogGroups", "Effect": "Allow", "Action": [ "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:GetDataProtectionPolicy", "logs:PutDataProtectionPolicy", "logs:DeleteDataProtectionPolicy", "logs:AssociateKmsKey", "logs:DisassociateKmsKey", "logs:ListTagsForResource" ], "Resource": [ "arn:aws:logs:*:*:log-group:datazone-*", "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide-*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AthenaWorkgroupCreationAndTagging", "Effect": "Allow", "Action": [ "athena:CreateWorkGroup", "athena:TagResource" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "AthenaWorkgroupDeletion", "Effect": "Allow", "Action": [ "athena:DeleteWorkGroup", "athena:GetWorkGroup" ], "Resource": "arn:aws:athena:*:*:workgroup/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftServerlessCreationAndTagging", "Effect": "Allow", "Action": [ "redshift-serverless:CreateNamespace", "redshift-serverless:CreateWorkgroup", "redshift-serverless:TagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "RedshiftServerlessListTags", "Effect": "Allow", "Action": [ "redshift-serverless:ListTagsForResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSecretManagement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false" } } }, { "Sid": "AllowDescribeSecretPerProject", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AllowDescribeSecretTaggedForAllProjects", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "AllowSecretTagging", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:ResourceTag/CreatedBy": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "CreatedBy" ] } } }, { "Sid": "SecretsManagerKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:SecretARN": "false" } } }, { "Sid": "ServiceLinkedRoleCreation", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": [ "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup" ] }, { "Sid": "RedshiftServerlessCreationPermissions", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:GetResourcePolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EC2PermissionsForGlueCatalog", "Effect": "Allow", "Action": [ "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones" ], "Resource": "*" }, { "Sid": "RedshiftServerlessCreateDatabaseRole", "Effect": "Allow", "Action": [ "redshift-data:ExecuteStatement", "redshift:GetResourcePolicy", "redshift-serverless:GetCredentials" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftDataDescribeStatement", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult" ], "Resource": "*" }, { "Sid": "RedshiftDatashareDescribe", "Effect": "Allow", "Action": [ "redshift:DescribeDataSharesForConsumer", "redshift:DescribeDataShares" ], "Resource": "*" }, { "Sid": "RedshiftServerlessValidation", "Effect": "Allow", "Action": [ "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RedshiftServerlessManagement", "Effect": "Allow", "Action": [ "redshift-serverless:UpdateNamespace", "redshift-serverless:UpdateWorkgroup", "redshift-serverless:UntagResource" ], "Resource": [ "arn:aws:redshift-serverless:*:*:namespace/*", "arn:aws:redshift-serverless:*:*:workgroup/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "RedshiftKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "redshift-serverless.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:redshift-serverless:arn": "false" } } }, { "Sid": "GetRandomPasswordForSecret", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "ManageSecretPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:DeleteResourcePolicy", "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManagedRedshiftAdminSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:RotateSecret", "secretsmanager:DescribeSecret", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "StringEquals": { "aws:CalledViaFirst": [ "cloudformation.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManagedRedshiftAdminSecretTaggingPermissions", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*", "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "Redshift", "aws:secretsmanager:*", "aws:redshift-serverless:*", "AmazonDataZone*", "datazone.rs.workgroup" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerDomainCreationAndTagging", "Effect": "Allow", "Action": [ "sagemaker:CreateDomain", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainUpdationAndDeletion", "Effect": "Allow", "Action": [ "sagemaker:UpdateDomain", "sagemaker:DeleteDomain" ], "Resource": "arn:aws:sagemaker:*:*:domain/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerDomainManagement", "Effect": "Allow", "Action": [ "sagemaker:ListDomains", "sagemaker:DescribeDomain" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "SageMakerAppDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteApp", "Resource": [ "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*", "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerSpaceDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteSpace", "Resource": "arn:aws:sagemaker:*:*:space/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerUserProfileDeletion", "Effect": "Allow", "Action": "sagemaker:DeleteUserProfile", "Resource": "arn:aws:sagemaker:*:*:user-profile/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessApplicationCreationAndTagging", "Effect": "Allow", "Action": [ "emr-serverless:CreateApplication", "emr-serverless:TagResource" ], "Resource": [ "arn:aws:emr-serverless:*:*:*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false", "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*" ] } } }, { "Sid": "EMRServerlessApplicationManagement", "Effect": "Allow", "Action": [ "emr-serverless:UpdateApplication", "emr-serverless:DeleteApplication" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "EMRServerlessGetApplication", "Effect": "Allow", "Action": "emr-serverless:GetApplication", "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerless", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateNetworkInterfaceForEMRServerlessSharedVPC", "Effect": "Allow", "Action": "ec2:CreateNetworkInterface", "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "ops.emr-serverless.amazonaws.com" } } }, { "Sid": "SageMakerMlflowTrackingServerCreation", "Effect": "Allow", "Action": [ "sagemaker:CreateMlflowTrackingServer", "sagemaker:AddTags" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "SageMakerMlflowTrackingServerDescribe", "Effect": "Allow", "Action": "sagemaker:DescribeMlflowTrackingServer", "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*" }, { "Sid": "SageMakerMlflowTrackingServerDeletion", "Effect": "Allow", "Action": [ "sagemaker:DeleteMlflowTrackingServer" ], "Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageAossAccessPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:UpdateAccessPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*", "aoss:index": "bedrock-ide-*" } } }, { "Sid": "ManageAossSecurityPoliciesForBedrock", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy", "aoss:DeleteSecurityPolicy", "aoss:UpdateSecurityPolicy" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "StringLikeIfExists": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetAossCollectionsForBedrock", "Effect": "Allow", "Action": "aoss:BatchGetCollection", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageAossCollectionsForBedrock", "Effect": "Allow", "Action": [ "aoss:CreateCollection", "aoss:UpdateCollection", "aoss:DeleteCollection", "aoss:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "GetBedrockCfnResourceDefinitionS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::*/dzd_*/*/genAI/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GetBedrockResources", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetKnowledgeBase", "bedrock:GetGuardrail", "bedrock:GetPrompt", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:ListTagsForResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ManageBedrockResources", "Effect": "Allow", "Action": [ "bedrock:CreateAgent", "bedrock:UpdateAgent", "bedrock:PrepareAgent", "bedrock:DeleteAgent", "bedrock:ListAgentAliases", "bedrock:GetAgentAlias", "bedrock:CreateAgentAlias", "bedrock:UpdateAgentAlias", "bedrock:DeleteAgentAlias", "bedrock:ListAgentActionGroups", "bedrock:GetAgentActionGroup", "bedrock:CreateAgentActionGroup", "bedrock:UpdateAgentActionGroup", "bedrock:DeleteAgentActionGroup", "bedrock:ListAgentKnowledgeBases", "bedrock:GetAgentKnowledgeBase", "bedrock:AssociateAgentKnowledgeBase", "bedrock:DisassociateAgentKnowledgeBase", "bedrock:UpdateAgentKnowledgeBase", "bedrock:CreateKnowledgeBase", "bedrock:UpdateKnowledgeBase", "bedrock:DeleteKnowledgeBase", "bedrock:ListDataSources", "bedrock:GetDataSource", "bedrock:CreateDataSource", "bedrock:UpdateDataSource", "bedrock:DeleteDataSource", "bedrock:CreateGuardrail", "bedrock:UpdateGuardrail", "bedrock:DeleteGuardrail", "bedrock:CreateGuardrailVersion", "bedrock:CreatePrompt", "bedrock:UpdatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:CreateFlow", "bedrock:UpdateFlow", "bedrock:PrepareFlow", "bedrock:DeleteFlow", "bedrock:ListFlowAliases", "bedrock:GetFlowAlias", "bedrock:CreateFlowAlias", "bedrock:UpdateFlowAlias", "bedrock:DeleteFlowAlias", "bedrock:ListFlowVersions", "bedrock:GetFlowVersion", "bedrock:CreateFlowVersion", "bedrock:DeleteFlowVersion", "bedrock:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "TagBedrockTestAliases", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": [ "arn:aws:bedrock:*:*:agent-alias/*/TSTALIASID", "arn:aws:bedrock:*:*:flow/*/alias/TSTALIASID" ], "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:RequestTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ListBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*" }, { "Sid": "ManageBedrockEvaluationJobsFromServicePermissions", "Effect": "Allow", "Action": "bedrock:BatchDeleteEvaluationJob", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "CreateFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration", "lambda:ListVersionsByFunction", "lambda:PublishVersion", "lambda:GetPolicy", "lambda:AddPermission", "lambda:TagResource" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "ManageFunctionPermissionsForBedrockApp", "Effect": "Allow", "Action": [ "lambda:GetFunction", "lambda:ListTags", "lambda:RemovePermission" ], "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRSecurityConfigurationManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:CreateSecurityConfiguration", "elasticmapreduce:DeleteSecurityConfiguration" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" } } }, { "Sid": "EMRClusterManagement", "Effect": "Allow", "Action": [ "elasticmapreduce:AddJobFlowSteps", "elasticmapreduce:AddTags", "elasticmapreduce:DescribeJobFlows", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ModifyInstanceFleet", "elasticmapreduce:RunJobFlow", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:DescribeCluster" ], "Resource": "arn:aws:elasticmapreduce:*:*:cluster/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "cloudformation.amazonaws.com" }, "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActions", "Effect": "Allow", "Action": [ "airflow:CreateEnvironment", "airflow:UpdateEnvironment", "airflow:DeleteEnvironment", "airflow:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "AirflowEnvironmentActionsWithoutRestrictions", "Effect": "Allow", "Action": [ "airflow:GetEnvironment" ], "Resource": "*" }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowVpcEndpointActions", "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc-endpoint/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AirflowNetworkInterfaceActions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid": "AirflowKmsCreateGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringLike": { "kms:ViaService": [ "airflow.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsDescribeKey", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRoleWithBoundary", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary" } } }, { "Sid": "IamRolePermissionsForCreatingSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "IamRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:DetachRolePolicy", "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy" ] } } }, { "Sid": "IamTagRolePermissionsForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": "iam:TagRole", "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "CreatedForUseWithSageMakerStudio", "SageMakerStudioQueryExecutionRole" ] } } }, { "Sid": "IamListAttachedPoliciesForSageMakerStudioQueryExecutionRole", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies" ], "Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SecurityGroupCleanUpForEMR", "Effect": "Allow", "Action": "ec2:DeleteSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMRoleCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListInstanceProfilesForRole", "iam:DeleteRolePolicy", "iam:DeleteRole" ], "Resource": "arn:aws:iam::*:role/datazone_emr_*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "IAMInstanceProfileCleanUpForEMR", "Effect": "Allow", "Action": [ "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource": "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-11-20T21:58:39.000Z", "lastUpdatedDate": "2025-03-21T20:07:07.000Z" }, "SageMakerStudioProjectUserRolePolicy": { "arn": "arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePolicy", "latestVersionId": "v8", "versionsCount": 8, "versions": { "v1": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:CalledVia": [ "glue.amazonaws.com" ] } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } } ] } }, "v2": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } } ] } }, "v3": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } } ] } }, "v4": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v5": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModelPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v6": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModelPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v7": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "GlueJobRunnerSessionLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws-glue/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" } } }, { "Sid": "EmrServerlessInteractivePermissions", "Effect": "Allow", "Action": [ "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:StartApplication", "emr-serverless:StopApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EmrServerlessJobAccessPermissions", "Effect": "Allow", "Action": [ "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection", "datazone:PostLineageEvent" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetDatabases", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "TagSessionForAssumeAccessRole", "Effect": "Allow", "Action": "sts:TagSession", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneProject", "AmazonDataZoneDomain" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:RequestTag/AmazonDataZoneDomain": "${aws:PrincipalTag/AmazonDataZoneDomain}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetSchemaInference" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "EMRPersistentAppUI", "Effect": "Allow", "Resource": "*", "Action": [ "elasticmapreduce:GetPersistentAppUIPresignedURL" ], "Condition": { "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockInvokeModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" }, "ArnLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:*:*:application-inference-profile/*" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockInvokeModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockResourceAccessPermissions", "Effect": "Allow", "Action": [ "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgentAlias", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:ListAgentAliases", "bedrock:ListAgentVersions", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:UpdateAgentAlias" ], "Resource": "arn:aws:bedrock:*:*:*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModelPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "BedrockCreateEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*::foundation-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockNoResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeInlineAgent", "bedrock:ListEvaluationJobs", "bedrock:RetrieveAndGenerate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrockPermissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockTagResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "arn:aws:bedrock:*:*:*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringEqualsIfExists": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonBedrockManaged", "AmazonDataZone*", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "KmsViaBedrockPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "ForAllValues:StringLike": { "kms:EncryptionContextKeys": [ "aws:bedrock*:arn", "aws:bedrock:guardrail-id" ] } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SecretsManagerPermissionsForBedrock", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "KmsViaSecretsManagerPermissionsForBedrock", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "LambdaInvokeFunctionViaBedrockPermissions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudFormationGetDataZoneEnvironmentStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedConnectionGetSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:*:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "FederatedConnectionLambdaLogsPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/athenafederatedcatalog*" }, { "Sid": "FederatedConnectionDDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "FederatedConnectionEC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeSubnets", "ec2:DetachNetworkInterface" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:Vpc": "${aws:PrincipalTag/vpcArn}" } } }, { "Sid": "FederatedConnectionDeleteENIPermissions", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:*/*", "Condition": { "StringEqualsIfExists": { "ec2:Vpc": "${aws:PrincipalTag/vpcArn}" } } }, { "Sid": "FederatedConnectionDescribeENIPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "PrivateECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:CompleteLayerUpload", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:BatchDeleteImage", "ecr:ListTagsForResource", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:UploadLayerPart" ], "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateECRRepositoryPermission", "Effect": "Allow", "Action": "ecr:CreateRepository", "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "ECRTagResourcePermission", "Effect": "Allow", "Action": "ecr:TagResource", "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZoneProject", "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringEqualsIfExists": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "ECRUntagResourcePermission", "Effect": "Allow", "Action": [ "ecr:UntagResource" ], "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions", "ram:GetResourceShareInvitations", "lakeformation:CreateDataCellsFilter", "lakeformation:ListDataCellsFilter", "lakeformation:DeleteDataCellsFilter", "lakeformation:GetDataCellsFilter", "lakeformation:UpdateDataCellsFilter", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:DeleteResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "RAMGetResourceSharesViaLakeFormation", "Effect": "Allow", "Action": [ "ram:GetResourceShares" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "ArnLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } } ] } }, "v8": { "createdDate": "2024-11-20T21:59:23.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CommonUserCodeCommitPermissions", "Effect": "Allow", "Action": [ "codecommit:BatchGetCommits", "codecommit:BatchGetPullRequests", "codecommit:BatchGetRepositories", "codecommit:BatchDescribeMergeConflicts", "codecommit:CreateBranch", "codecommit:CreateCommit", "codecommit:CreatePullRequest", "codecommit:DeleteBranch", "codecommit:DeleteFile", "codecommit:DescribeMergeConflicts", "codecommit:DescribePullRequestEvents", "codecommit:GetBlob", "codecommit:GetBranch", "codecommit:GetComment", "codecommit:GetCommentReactions", "codecommit:GetCommentsForComparedCommit", "codecommit:GetCommentsForPullRequest", "codecommit:GetCommit", "codecommit:GetCommitHistory", "codecommit:GetCommitsFromMergeBase", "codecommit:GetDifferences", "codecommit:GetFile", "codecommit:GetFolder", "codecommit:GetMergeCommit", "codecommit:GetMergeConflicts", "codecommit:GetMergeOptions", "codecommit:GetObjectIdentifier", "codecommit:GetPullRequest", "codecommit:GetPullRequestApprovalStates", "codecommit:GetPullRequestOverrideState", "codecommit:GetReferences", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codecommit:GetTree", "codecommit:GetUploadArchiveStatus", "codecommit:GitPull", "codecommit:GitPush", "codecommit:ListAssociatedApprovalRuleTemplatesForRepository", "codecommit:ListBranches", "codecommit:ListFileCommitHistory", "codecommit:ListPullRequests", "codecommit:ListTagsForResource", "codecommit:MergeBranchesByFastForward", "codecommit:MergeBranchesBySquash", "codecommit:MergeBranchesByThreeWay", "codecommit:MergePullRequestByFastForward", "codecommit:MergePullRequestBySquash", "codecommit:MergePullRequestByThreeWay", "codecommit:UpdateComment", "codecommit:UpdateDefaultBranch", "codecommit:UpdatePullRequestApprovalRuleContent", "codecommit:UpdatePullRequestApprovalState", "codecommit:UpdatePullRequestDescription", "codecommit:UpdatePullRequestStatus", "codecommit:UpdatePullRequestTitle", "codecommit:UpdateRepositoryDescription", "codecommit:PostCommentForComparedCommit", "codecommit:PostCommentForPullRequest", "codecommit:PostCommentReply", "codecommit:PutCommentReaction", "codecommit:PutFile" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CodeCommitKmsPermissions", "Effect": "Allow", "Action": [ "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:codecommit:id": "false" } } }, { "Sid": "AllowCodeWhispererGenerateRecommendations", "Effect": "Allow", "Action": [ "codewhisperer:GenerateRecommendations" ], "Resource": "*" }, { "Sid": "AllowGlueCreateEni", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "Null": { "aws:TagKeys": "true" } } }, { "Sid": "AllowGlueCreateEniOnSecurityGroup", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowGlueCreateEniOnSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:subnet/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "AllowManageGlueEni", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "aws:ResourceTag/aws-glue-service-resource": "false" } } }, { "Sid": "AllowAttachGlueEniOnInstance", "Effect": "Allow", "Action": [ "ec2:AttachNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowDescribeGlueEni", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com" } } }, { "Sid": "FederatedDataConnectionGlueSecret", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "*", "Condition": { "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueKernelPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "glue:ListSessions", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "GlueCreateAndTagPermissions", "Effect": "Allow", "Action": [ "glue:CreateSession", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateDataQualityRuleset", "glue:CreateWorkflow", "glue:TagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "ProjectUserTag*" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueTagSessionPermissions", "Effect": "Allow", "Action": [ "glue:TagResource", "glue:UntagResource" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:TagKeys": [ "AmazonDataZone*" ] }, "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GluePermissions", "Effect": "Allow", "Action": [ "glue:CancelStatement", "glue:GetSession", "glue:ListStatements", "glue:DeleteSession", "glue:RunStatement", "glue:GetStatement", "glue:StopSession", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:ResumeWorkflowRun", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", "glue:CancelDataQualityRuleRecommendationRun", "glue:CancelDataQualityRulesetEvaluationRun", "glue:DeleteDataQualityRuleset", "glue:GetDataQualityModel", "glue:GetDataQualityModelResult", "glue:GetDataQualityResult", "glue:GetDataQualityRuleRecommendationRun", "glue:GetDataQualityRuleset", "glue:GetDataQualityRulesetEvaluationRun", "glue:ListDataQualityResults", "glue:ListDataQualityRuleRecommendationRuns", "glue:ListDataQualityRulesetEvaluationRuns", "glue:ListDataQualityRulesets", "glue:PublishDataQuality", "glue:PutDataQualityProfileAnnotation", "glue:PutDataQualityStatisticAnnotation", "glue:StartDataQualityRuleRecommendationRun", "glue:StartDataQualityRulesetEvaluationRun", "glue:UpdateDataQualityRuleset" ], "Resource": [ "arn:aws:glue:*:*:session/*", "arn:aws:glue:*:*:blueprint/*", "arn:aws:glue:*:*:job/*", "arn:aws:glue:*:*:dataQualityRuleset/*", "arn:aws:glue:*:*:workflow/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:PrincipalTag/EnableGlueWorkloadsPermissions": "true" } } }, { "Sid": "GlueVisualETLPermissions", "Effect": "Allow", "Action": [ "glue:GetGeneratedCode" ], "Resource": "*" }, { "Sid": "GlueCompletionsPermissions", "Effect": "Allow", "Action": [ "glue:StartCompletion", "glue:GetCompletion" ], "Resource": "arn:aws:glue:*:*:completion/*" }, { "Sid": "GlueJobRunnerSessionLogPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws-glue/*" }, { "Sid": "EC2TagsPermissionsForGlue", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "Null": { "aws:TagKeys": "false" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "aws-glue-*" ] }, "StringEquals": { "glue:RoleAssumedBy": "glue.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "glue.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "kms:EncryptionContext:glue_catalog_id": "${aws:PrincipalAccount}" } } }, { "Sid": "EmrServerlessInteractivePermissions", "Effect": "Allow", "Action": [ "emr-serverless:AccessInteractiveEndpoints", "emr-serverless:AccessLivyEndpoints", "emr-serverless:GetApplication", "emr-serverless:StartApplication", "emr-serverless:StopApplication" ], "Resource": "arn:aws:emr-serverless:*:*:/applications/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EmrServerlessJobAccessPermissions", "Effect": "Allow", "Action": [ "emr-serverless:GetDashboardForJobRun", "emr-serverless:GetJobRun" ], "Resource": [ "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowActionsForTaggedEnvironments", "Effect": "Allow", "Action": [ "airflow:GetEnvironment", "airflow:UpdateEnvironment" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AirflowListEnvironments", "Effect": "Allow", "Action": [ "airflow:ListEnvironments" ], "Resource": "*" }, { "Sid": "AirflowUiApiAccess", "Effect": "Allow", "Action": [ "airflow:CreateWebLoginToken", "airflow:InvokeRestApi" ], "Resource": [ "arn:aws:airflow:*:*:role/DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}/User" ] }, { "Sid": "AirflowCloudwatchLogsActions", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults" ], "Resource": [ "arn:aws:logs:*:*:log-group:airflow-DataZoneMWAAEnv-${aws:PrincipalTag/AmazonDataZoneDomain}-${aws:PrincipalTag/AmazonDataZoneProject}-${aws:PrincipalTag/AmazonDataZoneScopeName}-*" ] }, { "Sid": "AirflowCloudwatchActions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringLike": { "cloudwatch:namespace": "AmazonMWAA" } } }, { "Sid": "AirflowS3GetAccountPublicAccessBlock", "Effect": "Allow", "Action": "s3:GetAccountPublicAccessBlock", "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowSqsActions", "Effect": "Allow", "Action": [ "sqs:ChangeMessageVisibility", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Resource": [ "arn:aws:sqs:*:*:airflow-celery-*" ], "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration", "s3:GetBucketPublicAccessBlock" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeS3BucketActions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountS3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "DataLakeCrossAccountKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:GetPublicKey", "kms:DescribeKey" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "DataLakeCrossAccountDecryptKMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ForAnyValue:StringEquals": { "kms:EncryptionContextKeys": "aws:s3:arn" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AirflowListDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListDomainBucketFromAthenaFederatedCatalog", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}" ], "Condition": { "ArnEquals": { "lambda:SourceFunctionArn": "arn:aws:lambda:*:*:function:athenafederatedcatalog_*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject", "s3:PutObjectRetention", "s3:RestoreObject", "s3:ReplicateObject", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "TagS3ObjectPermissionsForBedrockEvaluation", "Effect": "Allow", "Action": "s3:PutObjectTagging", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" }, "StringEquals": { "s3:RequestObjectTag/BasicValidationStatus": [ "valid", "invalid" ], "s3:RequestObjectTag/ContainsReferenceResponseForAllPrompts": [ "true", "false" ] }, "ForAllValues:StringEquals": { "s3:RequestObjectTagKeys": [ "BasicValidationStatus", "ContainsReferenceResponseForAllPrompts" ] } } }, { "Sid": "AccessDomainS3BucketKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid": "ListLogGroupsPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "*" }, { "Sid": "ProjectLogGroupPermissions", "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetLogRecord", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:PutLogEvents", "logs:CreateLogStream", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}", "arn:aws:logs:*:*:log-group:${aws:PrincipalTag/LogGroupName}:log-stream:*" ] }, { "Sid": "CloudWatchStopQuery", "Effect": "Allow", "Action": [ "logs:StopQuery" ], "Resource": "*" }, { "Sid": "DataLakeEC2Permissions", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DataLakeAthenaPermissions", "Effect": "Allow", "Action": [ "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGetNamedQuery", "athena:BatchGetPreparedStatement", "athena:BatchGetQueryExecution", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:GetCalculationExecution", "athena:GetCalculationExecutionCode", "athena:GetCalculationExecutionStatus", "athena:GetNamedQuery", "athena:GetNotebookMetadata", "athena:GetPreparedStatement", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetQueryResultsStream", "athena:GetQueryRuntimeStatistics", "athena:GetSession", "athena:GetSessionStatus", "athena:GetWorkGroup", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "athena:ListQueryExecutions", "athena:ListTagsForResource", "athena:ListNamedQueries", "athena:ListPreparedStatements" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "DefaultAthenaDataCatalogPermissions", "Effect": "Allow", "Action": [ "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetTableMetadata", "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource": [ "arn:aws:athena:*:*:datacatalog/AwsDataCatalog", "arn:aws:athena:*:*:datacatalog/awsdatacatalog" ] }, { "Sid": "AthenaListPermissions", "Effect": "Allow", "Action": [ "athena:ListDataCatalogs", "athena:ListEngineVersions", "athena:ListWorkGroups" ], "Resource": "*" }, { "Sid": "DataZoneUserPermissions", "Effect": "Allow", "Action": [ "datazone:CreateConnection", "datazone:DeleteConnection", "datazone:GetConnection", "datazone:GetDomain", "datazone:GetDomainExecutionRoleCredentials", "datazone:GetEnvironment", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetProject", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListEnvironments", "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection", "datazone:PostLineageEvent" ], "Resource": "arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}" }, { "Sid": "GlueGetDefaultDatabase", "Effect": "Allow", "Action": [ "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default" ] }, { "Sid": "AllowGlueGetDatabasesExceptDefault", "Effect": "Allow", "Action": "glue:GetDatabases", "NotResource": "arn:aws:glue:*:*:database/default", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueListDatabasesOnNoDatabases", "Effect": "Allow", "Action": [ "glue:GetDatabases" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueFileUploadPermissions", "Action": [ "glue:GetClassifier", "glue:GetClassifiers", "glue:UseGlueStudio" ], "Resource": "*", "Effect": "Allow" }, { "Sid": "GlueProjectConnectionPermissions", "Effect": "Allow", "Action": [ "glue:PassConnection", "glue:GetConnection", "glue:GetConnections" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueGetConnectionOnlyOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections" ], "Resource": "arn:aws:glue:*:*:catalog" }, { "Sid": "GlueDatalakePermissions", "Effect": "Allow", "Action": [ "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:BatchGetPartition", "glue:BatchGetTableOptimizer", "glue:GetCatalogImportStatus", "glue:GetColumnStatisticsForPartition", "glue:GetColumnStatisticsForTable", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetDatabase", "glue:GetPartition", "glue:GetPartitionIndexes", "glue:GetPartitions", "glue:GetTable", "glue:GetTableOptimizer", "glue:GetTableVersion", "glue:GetTableVersions", "glue:GetTables", "glue:SearchTables", "glue:ListTableOptimizerRuns", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:GetCatalogs", "glue:GetCatalog" ], "Resource": "*", "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueCrawlerPermissions", "Effect": "Allow", "Action": "glue:ListCrawls", "Resource": "arn:aws:glue:*:*:crawler/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "GlueGlobalTempDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GlueNonDefaultCatalogsPermissions", "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:UpdateCatalog" ], "Resource": [ "arn:aws:glue:*:*:catalog/*" ], "Condition": { "StringEquals": { "glue:LakeFormationPermissions": "Enabled", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GlueCatalogDatabasePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase" ], "Resource": [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid": "LakeFormationPermissionForDataLakeAccess", "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": "*" }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "IAMGetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowAssumeAccessRole", "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "SetSourceIdentityForAssumeAccessRole", "Effect": "Allow", "Action": "sts:SetSourceIdentity", "Resource": "*", "Condition": { "StringLike": { "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid": "TagSessionForAssumeAccessRole", "Effect": "Allow", "Action": "sts:TagSession", "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneProject", "AmazonDataZoneDomain" ] }, "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:RequestTag/AmazonDataZoneDomain": "${aws:PrincipalTag/AmazonDataZoneDomain}" } } }, { "Sid": "FederatedDataConnectionPermissions", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "UnRestrictedAccessForGlueEntities", "Effect": "Allow", "Action": [ "glue:ListConnectionTypes", "glue:DescribeConnectionType" ], "Resource": "*" }, { "Sid": "GlueEntitiesAccessForFederatedDatabase", "Effect": "Allow", "Action": [ "glue:ListEntities", "glue:DescribeEntity", "glue:GetEntityRecords" ], "Resource": "*" }, { "Sid": "AllowPassRoleOnProjectRoles", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}", "Condition": { "StringEquals": { "iam:PassedToService": [ "sagemaker.amazonaws.com", "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com" ], "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SQLWorkBenchActionsWithoutResourceType", "Effect": "Allow", "Action": [ "sqlworkbench:PutTab", "sqlworkbench:DeleteTab", "sqlworkbench:DriverExecute", "sqlworkbench:GetUserInfo", "sqlworkbench:ListTabs", "sqlworkbench:GetAutocompletionMetadata", "sqlworkbench:GetAutocompletionResource", "sqlworkbench:PassAccountSettings", "sqlworkbench:ListQueryExecutionHistory", "sqlworkbench:GetQueryExecutionHistory", "sqlworkbench:CreateConnection", "sqlworkbench:PutQCustomContext", "sqlworkbench:GetQCustomContext", "sqlworkbench:DeleteQCustomContext", "sqlworkbench:GetQSqlRecommendations", "sqlworkbench:GetQSqlPromptQuotas", "sqlworkbench:GetSchemaInference" ], "Resource": "*" }, { "Sid": "RedshiftDataActionsIAMSessionRestriction", "Effect": "Allow", "Action": [ "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:ListStatements" ], "Resource": "*", "Condition": { "StringEquals": { "redshift-data:statement-owner-iam-userid": "${aws:userid}" } } }, { "Sid": "RedshiftDataActionsForResources", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowAccessExistingRedshiftCompute", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetCredentials", "redshift:DescribeTags", "redshift:GetClusterCredentialsWithIAM", "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeTable", "redshift-data:ListDatabases", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "RedshiftWithoutResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:ListNamespaces", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters" ], "Resource": "*" }, { "Sid": "RedshiftServerlessWorkgroupWithResourceType", "Effect": "Allow", "Action": [ "redshift-serverless:GetWorkgroup", "redshift-serverless:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift:DescribeTags" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "RedshiftExistingComputeConnectToCatalog", "Effect": "Allow", "Action": [ "redshift:GetClusterCredentialsWithIAM" ], "Resource": "arn:aws:redshift:*:*:dbname:*/*", "Condition": { "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowListSecrets", "Effect": "Allow", "Action": "secretsmanager:ListSecrets", "Resource": "*" }, { "Sid": "RedshiftServerlessGetCredentialsOnlyForDbUser", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringLike": { "aws:PrincipalTag/RedshiftDbUser": [ "user-${aws:PrincipalTag/datazone:userId}*", "user-project@${aws:PrincipalTag/AmazonDataZoneProject}", "user-*@*" ] } } }, { "Sid": "RedshiftDataActionsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:CancelStatement", "redshift-data:GetStagingBucketLocation", "redshift-serverless:GetManagedWorkgroup" ], "Resource": "*", "Condition": { "StringLike": { "redshift-data:glue-catalog-arn": "arn:aws:glue:*:*:catalog/*" } } }, { "Sid": "RedshifServerlessCredentialsForManagedWorkgroup", "Effect": "Allow", "Action": [ "redshift-serverless:GetCredentials" ], "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "redshift-data.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowTagGetResources", "Effect": "Allow", "Action": "tag:GetResources", "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "sqlworkbench.amazonaws.com" } } }, { "Sid": "AllowGetSecretForRedShift", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudWatchMetricsPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource": "*" }, { "Sid": "AmazonQChatPermissions", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage" ], "Resource": "*" }, { "Sid": "EMRClusterWithDataZoneTags", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceFleets", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:GetManagedScalingPolicy", "elasticmapreduce:GetOnClusterAppUIPresignedURL" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRClusterInfoPermissions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListReleaseLabels", "elasticmapreduce:ListSupportedInstanceTypes", "elasticmapreduce:ListClusters", "elasticmapreduce:CreatePersistentAppUI", "elasticmapreduce:DescribePersistentAppUI", "pricing:GetProducts" ], "Resource": "*" }, { "Sid": "EMRGetClusterSessionCredentials", "Effect": "Allow", "Action": [ "elasticmapreduce:GetClusterSessionCredentials" ], "Resource": [ "arn:aws:elasticmapreduce:*:*:cluster/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "EMRPersistentAppUI", "Effect": "Allow", "Resource": "*", "Action": [ "elasticmapreduce:GetPersistentAppUIPresignedURL" ], "Condition": { "ArnLike": { "elasticmapreduce:ExecutionRoleArn": "arn:aws:iam::*:role/${aws:PrincipalTag/RoleName}" } } }, { "Sid": "KmsWithEncryptPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "bedrock.*.amazonaws.com", "s3.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "emr-serverless.*.amazonaws.com", "redshift.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "KmsManagementPermissions", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com", "emr-serverless.*.amazonaws.com", "s3.*.amazonaws.com", "redshift.*.amazonaws.com", "codecommit.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AwsOwnedKmsKeyPermissions", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com", "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AwsOwnedKmsManagementPermissions", "Action": [ "kms:DescribeKey" ], "Effect": "Allow", "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "sqs.*.amazonaws.com", "sagemaker.*.amazonaws.com" ] }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListKMSPermissions", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2PermissionsForNotebookExecution", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceTypes" ], "Resource": "*" }, { "Sid": "InvokeBedrockModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" }, "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockInvokeModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" }, "ArnLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:*:*:application-inference-profile/*" } } }, { "Sid": "InvokeBedrockModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockInvokeModelAppInferenceProfilePermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessBedrockResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeAgent", "bedrock:Retrieve", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob", "bedrock:GetIngestionJob", "bedrock:ApplyGuardrail", "bedrock:ListPrompts", "bedrock:GetPrompt", "bedrock:CreatePrompt", "bedrock:DeletePrompt", "bedrock:CreatePromptVersion", "bedrock:InvokeFlow", "bedrock:GetEvaluationJob", "bedrock:CreateEvaluationJob", "bedrock:StopEvaluationJob", "bedrock:BatchDeleteEvaluationJob", "bedrock:ListTagsForResource", "bedrock:CreateAgentAlias", "bedrock:ListAgentAliases", "bedrock:GetAgentVersion", "bedrock:ListAgentVersions", "bedrock:DeleteAgentVersion", "bedrock:DeleteAgentAlias", "bedrock:GetAgentAlias", "bedrock:UpdateAgentAlias" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockResourceAccessPermissions", "Effect": "Allow", "Action": [ "bedrock:ApplyGuardrail", "bedrock:BatchDeleteEvaluationJob", "bedrock:CreateAgentAlias", "bedrock:CreateEvaluationJob", "bedrock:CreatePrompt", "bedrock:CreatePromptVersion", "bedrock:DeleteAgentAlias", "bedrock:DeleteAgentVersion", "bedrock:DeletePrompt", "bedrock:GetAgentAlias", "bedrock:GetAgentVersion", "bedrock:GetEvaluationJob", "bedrock:GetIngestionJob", "bedrock:GetPrompt", "bedrock:InvokeAgent", "bedrock:InvokeFlow", "bedrock:ListAgentAliases", "bedrock:ListAgentVersions", "bedrock:ListIngestionJobs", "bedrock:ListPrompts", "bedrock:ListTagsForResource", "bedrock:Retrieve", "bedrock:StartIngestionJob", "bedrock:StopEvaluationJob", "bedrock:UpdateAgentAlias" ], "Resource": "arn:aws:bedrock:*:*:*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateEvaluationJobForFoundationModelPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ] }, { "Sid": "BedrockCreateEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:CreateEvaluationJob", "Resource": [ "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*::foundation-model/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" } } }, { "Sid": "InvokeBedrockInlineAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeInlineAgent", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "ListBedrockEvaluationJobPermissions", "Effect": "Allow", "Action": "bedrock:ListEvaluationJobs", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true" } } }, { "Sid": "BedrockNoResourcePermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeInlineAgent", "bedrock:ListEvaluationJobs", "bedrock:RetrieveAndGenerate" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true" } } }, { "Sid": "PassRoleToBedrockEvaluation", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "arn:aws:iam::*:role/AmazonBedrockServiceRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "iam:PassedToService": [ "bedrock.amazonaws.com" ] } } }, { "Sid": "IamPassRoleToBedrockPermissions", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*", "arn:aws:iam::*:role/AmazonBedrockServiceRole-${aws:PrincipalTag/AmazonDataZoneProject}-*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "iam:PassedToService": "bedrock.amazonaws.com" } } }, { "Sid": "TagBedrockResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZone*", "AmazonBedrockManaged", "ProjectUserTag*" ] } } }, { "Sid": "BedrockTagResourcePermissions", "Effect": "Allow", "Action": "bedrock:TagResource", "Resource": "arn:aws:bedrock:*:*:*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringEqualsIfExists": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonBedrockManaged", "AmazonDataZone*", "ProjectUserTag*" ] } } }, { "Sid": "BedrockKmsPermissions", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "Null": { "kms:EncryptionContext:aws:bedrock:arn": "false" } } }, { "Sid": "KmsViaBedrockPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "ForAllValues:StringLike": { "kms:EncryptionContextKeys": [ "aws:bedrock*:arn", "aws:bedrock:guardrail-id" ] } } }, { "Sid": "AccessSecretPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "SecretsManagerPermissionsForBedrock", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AccessSecretKmsPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*" } } }, { "Sid": "KmsViaSecretsManagerPermissionsForBedrock", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com" }, "ArnLike": { "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*" } } }, { "Sid": "InvokeFunctionPermissionsForAmazonBedrockIDE", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock-ide-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "LambdaInvokeFunctionViaBedrockPermissions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}", "aws:CalledViaFirst": "bedrock.amazonaws.com" } } }, { "Sid": "GetDataZoneEnvironmentCloudFormationStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockIDEPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CloudFormationGetDataZoneEnvironmentStackPermissions", "Effect": "Allow", "Action": [ "cloudformation:DescribeStacks", "cloudformation:GetTemplate" ], "Resource": "arn:aws:cloudformation:*:*:stack/DataZone-Env-*", "Condition": { "StringEquals": { "aws:PrincipalTag/EnableAmazonBedrockPermissions": "true", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "GetGlueUserDefinedFuncLakeFormationPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "glue:LakeFormationPermissions": "Enabled" } } }, { "Sid": "GetGlueUserDefinedFuncPermissions", "Effect": "Allow", "Action": [ "glue:GetUserDefinedFunction", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "FederatedConnectionGetSecretPermissions", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:*:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "FederatedConnectionLambdaLogsPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/athenafederatedcatalog*" }, { "Sid": "FederatedConnectionDDBPermissions", "Effect": "Allow", "Action": [ "dynamodb:ListTables" ], "Resource": "*" }, { "Sid": "FederatedConnectionEC2Permissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeSubnets", "ec2:DetachNetworkInterface" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:Vpc": "${aws:PrincipalTag/vpcArn}" } } }, { "Sid": "FederatedConnectionDeleteENIPermissions", "Effect": "Allow", "Action": "ec2:DeleteNetworkInterface", "Resource": "arn:aws:ec2:*:*:*/*", "Condition": { "StringEqualsIfExists": { "ec2:Vpc": "${aws:PrincipalTag/vpcArn}" } } }, { "Sid": "FederatedConnectionDescribeENIPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Sid": "PrivateECRPermissions", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:CompleteLayerUpload", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:BatchDeleteImage", "ecr:ListTagsForResource", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:UploadLayerPart" ], "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "CreateECRRepositoryPermission", "Effect": "Allow", "Action": "ecr:CreateRepository", "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "StringEquals": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "ECRTagResourcePermission", "Effect": "Allow", "Action": "ecr:TagResource", "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "AmazonDataZoneProject", "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" }, "StringEqualsIfExists": { "aws:RequestTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "ECRUntagResourcePermission", "Effect": "Allow", "Action": [ "ecr:UntagResource" ], "Resource": "arn:aws:ecr:*:*:repository/*", "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "ProjectUserTag*" ] }, "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "LakeformationResourceSharingPermissions", "Effect": "Allow", "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:ListPermissions", "ram:GetResourceShareInvitations", "lakeformation:CreateDataCellsFilter", "lakeformation:ListDataCellsFilter", "lakeformation:DeleteDataCellsFilter", "lakeformation:GetDataCellsFilter", "lakeformation:UpdateDataCellsFilter", "ram:ListResources" ], "Resource": "*" }, { "Sid": "CrossAccountLakeFormationResourceSharingPermissions", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingPermissions", "Effect": "Allow", "Action": [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "ram.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", "Effect": "Allow", "Action": [ "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:DeleteResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "RAMGetResourceSharesViaLakeFormation", "Effect": "Allow", "Action": [ "ram:GetResourceShares" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } }, { "Sid": "CrossAccountRAMResourceShareInvitationPermission", "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation" ], "Resource": "arn:aws:ram:*:*:resource-share-invitation/*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "LakeFormation*" ] } } }, { "Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect": "Allow", "Action": "ram:AssociateResourceSharePermission", "Resource": "*", "Condition": { "ArnLike": { "ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "lakeformation.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-11-20T21:59:23.000Z", "lastUpdatedDate": "2025-03-21T20:07:06.000Z" }, "AWSArtifactAgreementsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSArtifactAgreementsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-22T19:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListAgreementActions", "Effect": "Allow", "Action": [ "artifact:ListAgreements", "artifact:ListCustomerAgreements" ], "Resource": "*" }, { "Sid": "AWSAgreementActions", "Effect": "Allow", "Action": [ "artifact:GetAgreement", "artifact:AcceptNdaForAgreement", "artifact:GetNdaForAgreement", "artifact:AcceptAgreement" ], "Resource": "arn:aws:artifact:::agreement/*" }, { "Sid": "CustomerAgreementActions", "Effect": "Allow", "Action": [ "artifact:GetCustomerAgreement", "artifact:TerminateAgreement" ], "Resource": "arn:aws:artifact::*:customer-agreement/*" }, { "Sid": "CreateServiceLinkedRoleForOrganizationsIntegration", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/artifact.amazonaws.com/AWSServiceRoleForArtifact", "Condition": { "StringEquals": { "iam:AWSServiceName": [ "artifact.amazonaws.com" ] } } }, { "Sid": "GetRoleToCheckForRoleExistence", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/artifact.amazonaws.com/AWSServiceRoleForArtifact" }, { "Sid": "EnableServiceTrust", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": "*" } ] } } }, "createdDate": "2024-11-22T19:36:07.000Z", "lastUpdatedDate": "2024-11-22T19:36:07.000Z" }, "AWSArtifactAgreementsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSArtifactAgreementsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-22T19:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ListAgreementsActions", "Effect": "Allow", "Action": [ "artifact:ListAgreements", "artifact:ListCustomerAgreements" ], "Resource": "*" }, { "Sid": "GetCustomerAgreementActions", "Effect": "Allow", "Action": [ "artifact:GetCustomerAgreement" ], "Resource": "arn:aws:artifact::*:customer-agreement/*" }, { "Sid": "AWSOrganizationActions", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "GetRole", "Effect": "Allow", "Action": [ "iam:GetRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/artifact.amazonaws.com/AWSServiceRoleForArtifact" } ] } } }, "createdDate": "2024-11-22T19:36:07.000Z", "lastUpdatedDate": "2024-11-22T19:36:07.000Z" }, "AWSPartnerLedSupportReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSPartnerLedSupportReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-22T20:06:06.000Z", "document": { "Statement": [ { "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses", "arn:aws:apigateway:*::/apis/*/integrations/*/integrationresponses/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses", "arn:aws:apigateway:*::/apis/*/routes/*/routeresponses/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/domainnames/*/apimappings/*", "arn:aws:apigateway:*::/domainnames/*/basepathmappings", "arn:aws:apigateway:*::/domainnames/*/basepathmappings/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models/*/default_template", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration/responses/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/responses/*", "arn:aws:apigateway:*::/restapis/*/stages/*/sdks/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*", "arn:aws:apigateway:*::/vpclinks", "arn:aws:apigateway:*::/vpclinks/*" ] }, { "Effect": "Allow", "Action": [ "acm-pca:describeCertificateAuthority", "acm-pca:describeCertificateAuthorityAuditReport", "acm-pca:getCertificate", "acm-pca:getCertificateAuthorityCertificate", "acm-pca:getCertificateAuthorityCsr", "acm-pca:listCertificateAuthorities", "acm-pca:listTags", "acm:describeCertificate", "acm:getAccountConfiguration", "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", "athena:batchGetNamedQuery", "athena:batchGetQueryExecution", "athena:getCalculationExecution", "athena:getCalculationExecutionStatus", "athena:getDataCatalog", "athena:getNamedQuery", "athena:getNotebookMetadata", "athena:getQueryExecution", "athena:getQueryRuntimeStatistics", "athena:getSession", "athena:getSessionStatus", "athena:getWorkGroup", "athena:listApplicationDPUSizes", "athena:listCalculationExecutions", "athena:listDataCatalogs", "athena:listEngineVersions", "athena:listExecutors", "athena:listNamedQueries", "athena:listNotebookMetadata", "athena:listNotebookSessions", "athena:listQueryExecutions", "athena:listSessions", "athena:listTagsForResource", "athena:listWorkGroups", "backup-gateway:getGateway", "backup-gateway:getHypervisor", "backup-gateway:getHypervisorPropertyMappings", "backup-gateway:getVirtualMachine", "backup-gateway:listGateways", "backup-gateway:listHypervisors", "backup-gateway:listVirtualMachines", "backup:describeBackupJob", "backup:describeBackupVault", "backup:describeCopyJob", "backup:describeFramework", "backup:describeGlobalSettings", "backup:describeProtectedResource", "backup:describeRecoveryPoint", "backup:describeRegionSettings", "backup:describeReportJob", "backup:describeReportPlan", "backup:describeRestoreJob", "backup:getBackupPlan", "backup:getBackupPlanFromJSON", "backup:getBackupPlanFromTemplate", "backup:getBackupSelection", "backup:getBackupVaultAccessPolicy", "backup:getBackupVaultNotifications", "backup:getLegalHold", "backup:getRecoveryPointRestoreMetadata", "backup:getRestoreJobMetadata", "backup:getRestoreTestingInferredMetadata", "backup:getRestoreTestingPlan", "backup:getRestoreTestingSelection", "backup:getSupportedResourceTypes", "backup:listBackupJobs", "backup:listBackupPlanTemplates", "backup:listBackupPlanVersions", "backup:listBackupPlans", "backup:listBackupSelections", "backup:listBackupVaults", "backup:listCopyJobs", "backup:listFrameworks", "backup:listLegalHolds", "backup:listProtectedResources", "backup:listRecoveryPointsByBackupVault", "backup:listRecoveryPointsByLegalHold", "backup:listRecoveryPointsByResource", "backup:listReportJobs", "backup:listReportPlans", "backup:listRestoreJobs", "backup:listRestoreJobsByProtectedResource", "backup:listRestoreTestingPlans", "backup:listRestoreTestingSelections", "backup:listTags", "cloudformation:batchDescribeTypeConfigurations", "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", "cloudformation:describePublisher", "cloudformation:describeStackEvents", "cloudformation:describeStackInstance", "cloudformation:describeStackResource", "cloudformation:describeStackResources", "cloudformation:describeStackSet", "cloudformation:describeStackSetOperation", "cloudformation:describeStacks", "cloudformation:describeType", "cloudformation:describeTypeRegistration", "cloudformation:estimateTemplateCost", "cloudformation:getStackPolicy", "cloudformation:getTemplate", "cloudformation:getTemplateSummary", "cloudformation:listChangeSets", "cloudformation:listExports", "cloudformation:listImports", "cloudformation:listStackInstances", "cloudformation:listStackResources", "cloudformation:listStackSetOperationResults", "cloudformation:listStackSetOperations", "cloudformation:listStackSets", "cloudformation:listStacks", "cloudformation:listTypeRegistrations", "cloudformation:listTypeVersions", "cloudformation:listTypes", "cloudfront:describeFunction", "cloudfront:getCachePolicy", "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", "cloudfront:getInvalidation", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", "cloudfront:getOriginRequestPolicy", "cloudfront:getOriginRequestPolicyConfig", "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByCachePolicyId", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", "cloudfront:listDistributionsByWebACLId", "cloudfront:listFunctions", "cloudfront:listInvalidations", "cloudfront:listKeyGroups", "cloudfront:listOriginAccessControls", "cloudfront:listOriginRequestPolicies", "cloudfront:listPublicKeys", "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", "cloudtrail:describeTrails", "cloudtrail:getEventSelectors", "cloudtrail:lookupEvents", "cloudwatch:describeAlarmHistory", "cloudwatch:describeAlarms", "cloudwatch:describeAlarmsForMetric", "cloudwatch:describeAnomalyDetectors", "cloudwatch:describeInsightRules", "cloudwatch:getDashboard", "cloudwatch:getInsightRuleReport", "cloudwatch:getMetricData", "cloudwatch:getMetricStatistics", "cloudwatch:getMetricStream", "cloudwatch:listDashboards", "cloudwatch:listManagedInsightRules", "cloudwatch:listMetricStreams", "cloudwatch:listMetrics", "codepipeline:getPipeline", "codepipeline:getPipelineState", "codepipeline:listActionTypes", "codepipeline:listPipelineExecutions", "codepipeline:listPipelines", "cognito-identity:describeIdentityPool", "cognito-identity:getIdentityPoolRoles", "cognito-identity:listIdentities", "cognito-identity:listIdentityPools", "cognito-idp:describeIdentityProvider", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", "cognito-idp:describeUserPool", "cognito-idp:describeUserPoolClient", "cognito-idp:describeUserPoolDomain", "cognito-idp:getGroup", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", "cognito-sync:describeDataset", "cognito-sync:describeIdentityPoolUsage", "cognito-sync:describeIdentityUsage", "cognito-sync:getCognitoEvents", "cognito-sync:getIdentityPoolConfiguration", "cognito-sync:listDatasets", "cognito-sync:listIdentityPoolUsage", "connect:describeContact", "connect:describePhoneNumber", "connect:describeQuickConnect", "connect:describeUser", "connect:getCurrentMetricData", "connect:getMetricData", "connect:listContactEvaluations", "connect:listEvaluationFormVersions", "connect:listEvaluationForms", "connect:listPhoneNumbersV2", "connect:listQuickConnects", "connect:listRoutingProfiles", "connect:listSecurityProfiles", "connect:listUsers", "connect:listViewVersions", "connect:listViews", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", "directconnect:describeCustomerMetadata", "directconnect:describeDirectConnectGatewayAssociationProposals", "directconnect:describeDirectConnectGatewayAssociations", "directconnect:describeDirectConnectGatewayAttachments", "directconnect:describeDirectConnectGateways", "directconnect:describeHostedConnections", "directconnect:describeInterconnectLoa", "directconnect:describeInterconnects", "directconnect:describeLags", "directconnect:describeLoa", "directconnect:describeLocations", "directconnect:describeRouterConfiguration", "directconnect:describeVirtualGateways", "directconnect:describeVirtualInterfaces", "dms:describeAccountAttributes", "dms:describeApplicableIndividualAssessments", "dms:describeConnections", "dms:describeEndpointSettings", "dms:describeEndpointTypes", "dms:describeEndpoints", "dms:describeEventCategories", "dms:describeEventSubscriptions", "dms:describeEvents", "dms:describeFleetAdvisorCollectors", "dms:describeFleetAdvisorDatabases", "dms:describeFleetAdvisorLsaAnalysis", "dms:describeFleetAdvisorSchemaObjectSummary", "dms:describeFleetAdvisorSchemas", "dms:describeOrderableReplicationInstances", "dms:describePendingMaintenanceActions", "dms:describeRefreshSchemasStatus", "dms:describeReplicationInstanceTaskLogs", "dms:describeReplicationInstances", "dms:describeReplicationSubnetGroups", "dms:describeReplicationTaskAssessmentResults", "dms:describeReplicationTaskAssessmentRuns", "dms:describeReplicationTaskIndividualAssessments", "dms:describeReplicationTasks", "dms:describeSchemas", "dms:describeTableStatistics", "ds:describeClientAuthenticationSettings", "ds:describeConditionalForwarders", "ds:describeDirectories", "ds:describeDomainControllers", "ds:describeEventTopics", "ds:describeLDAPSSettings", "ds:describeSharedDirectories", "ds:describeSnapshots", "ds:describeTrusts", "ds:getDirectoryLimits", "ds:getSnapshotLimits", "ds:listIpRoutes", "ds:listSchemaExtensions", "ds:listTagsForResource", "ec2:describeAccountAttributes", "ec2:describeAddressTransfers", "ec2:describeAddresses", "ec2:describeAddressesAttribute", "ec2:describeAggregateIdFormat", "ec2:describeAvailabilityZones", "ec2:describeBundleTasks", "ec2:describeByoipCidrs", "ec2:describeCapacityReservationFleets", "ec2:describeCapacityReservations", "ec2:describeCarrierGateways", "ec2:describeClassicLinkInstances", "ec2:describeClientVpnAuthorizationRules", "ec2:describeClientVpnConnections", "ec2:describeClientVpnEndpoints", "ec2:describeClientVpnRoutes", "ec2:describeClientVpnTargetNetworks", "ec2:describeCoipPools", "ec2:describeConversionTasks", "ec2:describeCustomerGateways", "ec2:describeDhcpOptions", "ec2:describeEgressOnlyInternetGateways", "ec2:describeExportImageTasks", "ec2:describeExportTasks", "ec2:describeFastLaunchImages", "ec2:describeFastSnapshotRestores", "ec2:describeFleetHistory", "ec2:describeFleetInstances", "ec2:describeFleets", "ec2:describeFlowLogs", "ec2:describeFpgaImageAttribute", "ec2:describeFpgaImages", "ec2:describeHostReservationOfferings", "ec2:describeHostReservations", "ec2:describeHosts", "ec2:describeIamInstanceProfileAssociations", "ec2:describeIdFormat", "ec2:describeIdentityIdFormat", "ec2:describeImageAttribute", "ec2:describeImages", "ec2:describeImportImageTasks", "ec2:describeImportSnapshotTasks", "ec2:describeInstanceAttribute", "ec2:describeInstanceCreditSpecifications", "ec2:describeInstanceEventNotificationAttributes", "ec2:describeInstanceEventWindows", "ec2:describeInstanceStatus", "ec2:describeInstanceTypeOfferings", "ec2:describeInstanceTypes", "ec2:describeInstances", "ec2:describeInternetGateways", "ec2:describeIpamPools", "ec2:describeIpamScopes", "ec2:describeIpams", "ec2:describeIpv6Pools", "ec2:describeKeyPairs", "ec2:describeLaunchTemplateVersions", "ec2:describeLaunchTemplates", "ec2:describeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:describeLocalGatewayRouteTableVpcAssociations", "ec2:describeLocalGatewayRouteTables", "ec2:describeLocalGatewayVirtualInterfaceGroups", "ec2:describeLocalGatewayVirtualInterfaces", "ec2:describeLocalGateways", "ec2:describeManagedPrefixLists", "ec2:describeMovingAddresses", "ec2:describeNatGateways", "ec2:describeNetworkAcls", "ec2:describeNetworkInterfaceAttribute", "ec2:describeNetworkInterfaces", "ec2:describePlacementGroups", "ec2:describePrefixLists", "ec2:describePrincipalIdFormat", "ec2:describePublicIpv4Pools", "ec2:describeRegions", "ec2:describeReservedInstances", "ec2:describeReservedInstancesListings", "ec2:describeReservedInstancesModifications", "ec2:describeReservedInstancesOfferings", "ec2:describeRouteTables", "ec2:describeScheduledInstanceAvailability", "ec2:describeScheduledInstances", "ec2:describeSecurityGroupReferences", "ec2:describeSecurityGroupRules", "ec2:describeSecurityGroups", "ec2:describeSnapshotAttribute", "ec2:describeSnapshotTierStatus", "ec2:describeSnapshots", "ec2:describeSpotDatafeedSubscription", "ec2:describeSpotFleetInstances", "ec2:describeSpotFleetRequestHistory", "ec2:describeSpotFleetRequests", "ec2:describeSpotInstanceRequests", "ec2:describeSpotPriceHistory", "ec2:describeStaleSecurityGroups", "ec2:describeStoreImageTasks", "ec2:describeSubnets", "ec2:describeTags", "ec2:describeTrafficMirrorFilters", "ec2:describeTrafficMirrorSessions", "ec2:describeTrafficMirrorTargets", "ec2:describeTransitGatewayAttachments", "ec2:describeTransitGatewayConnectPeers", "ec2:describeTransitGatewayMulticastDomains", "ec2:describeTransitGatewayPeeringAttachments", "ec2:describeTransitGatewayPolicyTables", "ec2:describeTransitGatewayRouteTableAnnouncements", "ec2:describeTransitGatewayRouteTables", "ec2:describeTransitGatewayVpcAttachments", "ec2:describeTransitGateways", "ec2:describeVerifiedAccessEndpoints", "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstances", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumeStatus", "ec2:describeVolumes", "ec2:describeVolumesModifications", "ec2:describeVpcAttribute", "ec2:describeVpcClassicLink", "ec2:describeVpcClassicLinkDnsSupport", "ec2:describeVpcEndpointConnectionNotifications", "ec2:describeVpcEndpointConnections", "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", "ec2:describeVpcEndpoints", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", "ec2:describeVpnGateways", "ec2:getAssociatedIpv6PoolCidrs", "ec2:getCapacityReservationUsage", "ec2:getCoipPoolUsage", "ec2:getConsoleOutput", "ec2:getConsoleScreenshot", "ec2:getDefaultCreditSpecification", "ec2:getEbsDefaultKmsKeyId", "ec2:getEbsEncryptionByDefault", "ec2:getGroupsForCapacityReservation", "ec2:getHostReservationPurchasePreview", "ec2:getInstanceTypesFromInstanceRequirements", "ec2:getIpamAddressHistory", "ec2:getIpamPoolAllocations", "ec2:getIpamPoolCidrs", "ec2:getIpamResourceCidrs", "ec2:getLaunchTemplateData", "ec2:getManagedPrefixListAssociations", "ec2:getManagedPrefixListEntries", "ec2:getReservedInstancesExchangeQuote", "ec2:getSerialConsoleAccessStatus", "ec2:getSpotPlacementScores", "ec2:getSubnetCidrReservations", "ec2:getTransitGatewayMulticastDomainAssociations", "ec2:getTransitGatewayPrefixListReferences", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", "ec2:searchTransitGatewayMulticastGroups", "ec2:searchTransitGatewayRoutes", "ecs:describeCapacityProviders", "ecs:describeClusters", "ecs:describeContainerInstances", "ecs:describeServices", "ecs:describeTaskDefinition", "ecs:describeTaskSets", "ecs:describeTasks", "ecs:getTaskProtection", "ecs:listAccountSettings", "ecs:listAttributes", "ecs:listClusters", "ecs:listContainerInstances", "ecs:listServices", "ecs:listServicesByNamespace", "ecs:listTagsForResource", "ecs:listTaskDefinitionFamilies", "ecs:listTaskDefinitions", "ecs:listTasks", "eks:describeAccessEntry", "eks:describeAddon", "eks:describeAddonConfiguration", "eks:describeAddonVersions", "eks:describeCluster", "eks:describeEksAnywhereSubscription", "eks:describeFargateProfile", "eks:describeIdentityProviderConfig", "eks:describeNodegroup", "eks:describePodIdentityAssociation", "eks:describeUpdate", "eks:listAccessEntries", "eks:listAccessPolicies", "eks:listAddons", "eks:listAssociatedAccessPolicies", "eks:listClusters", "eks:listEksAnywhereSubscriptions", "eks:listFargateProfiles", "eks:listIdentityProviderConfigs", "eks:listNodegroups", "eks:listPodIdentityAssociations", "eks:listUpdates", "elasticache:describeCacheClusters", "elasticache:describeCacheEngineVersions", "elasticache:describeCacheParameterGroups", "elasticache:describeCacheParameters", "elasticache:describeCacheSecurityGroups", "elasticache:describeCacheSubnetGroups", "elasticache:describeEngineDefaultParameters", "elasticache:describeEvents", "elasticache:describeGlobalReplicationGroups", "elasticache:describeReplicationGroups", "elasticache:describeReservedCacheNodes", "elasticache:describeReservedCacheNodesOfferings", "elasticache:describeServerlessCacheSnapshots", "elasticache:describeServerlessCaches", "elasticache:describeServiceUpdates", "elasticache:describeSnapshots", "elasticache:describeUpdateActions", "elasticache:describeUserGroups", "elasticache:describeUsers", "elasticache:listAllowedNodeTypeModifications", "elasticache:listTagsForResource", "elasticbeanstalk:checkDNSAvailability", "elasticbeanstalk:describeAccountAttributes", "elasticbeanstalk:describeApplicationVersions", "elasticbeanstalk:describeApplications", "elasticbeanstalk:describeConfigurationOptions", "elasticbeanstalk:describeEnvironmentHealth", "elasticbeanstalk:describeEnvironmentManagedActionHistory", "elasticbeanstalk:describeEnvironmentManagedActions", "elasticbeanstalk:describeEnvironmentResources", "elasticbeanstalk:describeEnvironments", "elasticbeanstalk:describeEvents", "elasticbeanstalk:describeInstancesHealth", "elasticbeanstalk:describePlatformVersion", "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", "elasticfilesystem:describeFileSystemPolicy", "elasticfilesystem:describeFileSystems", "elasticfilesystem:describeLifecycleConfiguration", "elasticfilesystem:describeMountTargetSecurityGroups", "elasticfilesystem:describeMountTargets", "elasticfilesystem:describeTags", "elasticfilesystem:listTagsForResource", "elasticloadbalancing:describeAccountLimits", "elasticloadbalancing:describeInstanceHealth", "elasticloadbalancing:describeListenerCertificates", "elasticloadbalancing:describeListeners", "elasticloadbalancing:describeLoadBalancerAttributes", "elasticloadbalancing:describeLoadBalancerPolicies", "elasticloadbalancing:describeLoadBalancerPolicyTypes", "elasticloadbalancing:describeLoadBalancers", "elasticloadbalancing:describeRules", "elasticloadbalancing:describeSSLPolicies", "elasticloadbalancing:describeTags", "elasticloadbalancing:describeTargetGroupAttributes", "elasticloadbalancing:describeTargetGroups", "elasticloadbalancing:describeTargetHealth", "elasticloadbalancing:describeTrustStoreAssociations", "elasticloadbalancing:describeTrustStoreRevocations", "elasticloadbalancing:describeTrustStores", "emr-containers:describeJobRun", "emr-containers:describeJobTemplate", "emr-containers:describeManagedEndpoint", "emr-containers:describeVirtualCluster", "emr-containers:listJobRuns", "emr-containers:listJobTemplates", "emr-containers:listManagedEndpoints", "emr-containers:listVirtualClusters", "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", "es:describeDomainConfig", "es:describeDomains", "es:describeDryRunProgress", "es:describeElasticsearchDomain", "es:describeElasticsearchDomainConfig", "es:describeElasticsearchDomains", "es:describeInboundConnections", "es:describeInstanceTypeLimits", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", "es:describeReservedInstances", "es:describeVpcEndpoints", "es:getCompatibleVersions", "es:getPackageVersionHistory", "es:getUpgradeHistory", "es:getUpgradeStatus", "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", "es:listVersions", "es:listVpcEndpointAccess", "es:listVpcEndpoints", "es:listVpcEndpointsForDomain", "events:describeApiDestination", "events:describeArchive", "events:describeConnection", "events:describeEndpoint", "events:describeEventBus", "events:describeEventSource", "events:describePartnerEventSource", "events:describeReplay", "events:describeRule", "events:listApiDestinations", "events:listArchives", "events:listConnections", "events:listEndpoints", "events:listEventBuses", "events:listEventSources", "events:listPartnerEventSourceAccounts", "events:listPartnerEventSources", "events:listReplays", "events:listRuleNamesByTarget", "events:listRules", "events:listTargetsByRule", "events:testEventPattern", "fsx:describeBackups", "fsx:describeDataRepositoryAssociations", "fsx:describeDataRepositoryTasks", "fsx:describeFileCaches", "fsx:describeFileSystems", "fsx:describeSnapshots", "fsx:describeStorageVirtualMachines", "fsx:describeVolumes", "fsx:listTagsForResource", "glue:batchGetBlueprints", "glue:batchGetCrawlers", "glue:batchGetDevEndpoints", "glue:batchGetJobs", "glue:batchGetPartition", "glue:batchGetTriggers", "glue:batchGetWorkflows", "glue:checkSchemaVersionValidity", "glue:getBlueprint", "glue:getBlueprintRun", "glue:getBlueprintRuns", "glue:getCatalogImportStatus", "glue:getClassifier", "glue:getClassifiers", "glue:getColumnStatisticsForPartition", "glue:getColumnStatisticsForTable", "glue:getCrawler", "glue:getCrawlerMetrics", "glue:getCrawlers", "glue:getCustomEntityType", "glue:getDataQualityResult", "glue:getDataQualityRuleRecommendationRun", "glue:getDataQualityRuleset", "glue:getDataQualityRulesetEvaluationRun", "glue:getDatabase", "glue:getDatabases", "glue:getDataflowGraph", "glue:getDevEndpoint", "glue:getDevEndpoints", "glue:getJob", "glue:getJobRun", "glue:getJobRuns", "glue:getJobs", "glue:getMLTaskRun", "glue:getMLTaskRuns", "glue:getMLTransform", "glue:getMLTransforms", "glue:getMapping", "glue:getPartition", "glue:getPartitionIndexes", "glue:getPartitions", "glue:getRegistry", "glue:getResourcePolicies", "glue:getResourcePolicy", "glue:getSchema", "glue:getSchemaByDefinition", "glue:getSchemaVersion", "glue:getSchemaVersionsDiff", "glue:getSession", "glue:getStatement", "glue:getTable", "glue:getTableVersions", "glue:getTables", "glue:getTrigger", "glue:getTriggers", "glue:getUserDefinedFunction", "glue:getUserDefinedFunctions", "glue:getWorkflow", "glue:getWorkflowRun", "glue:getWorkflowRuns", "glue:listCrawlers", "glue:listCrawls", "glue:listDataQualityResults", "glue:listDataQualityRuleRecommendationRuns", "glue:listDataQualityRulesetEvaluationRuns", "glue:listDataQualityRulesets", "glue:listDevEndpoints", "glue:listMLTransforms", "glue:listRegistries", "glue:listSchemaVersions", "glue:listSchemas", "glue:listSessions", "glue:listStatements", "glue:querySchemaVersionMetadata", "guardduty:getFindings", "guardduty:listDetectors", "guardduty:listFindings", "guardduty:listIPSets", "guardduty:listThreatIntelSets", "iam:getAccessKeyLastUsed", "iam:getAccountAuthorizationDetails", "iam:getAccountPasswordPolicy", "iam:getAccountSummary", "iam:getContextKeysForCustomPolicy", "iam:getContextKeysForPrincipalPolicy", "iam:getCredentialReport", "iam:getGroup", "iam:getGroupPolicy", "iam:getInstanceProfile", "iam:getLoginProfile", "iam:getOpenIDConnectProvider", "iam:getPolicy", "iam:getPolicyVersion", "iam:getRole", "iam:getRolePolicy", "iam:getSAMLProvider", "iam:getSSHPublicKey", "iam:getServerCertificate", "iam:getServiceLinkedRoleDeletionStatus", "iam:getUser", "iam:getUserPolicy", "iam:listAccessKeys", "iam:listAccountAliases", "iam:listAttachedGroupPolicies", "iam:listAttachedRolePolicies", "iam:listAttachedUserPolicies", "iam:listEntitiesForPolicy", "iam:listGroupPolicies", "iam:listGroups", "iam:listGroupsForUser", "iam:listInstanceProfiles", "iam:listInstanceProfilesForRole", "iam:listMFADevices", "iam:listOpenIDConnectProviders", "iam:listPolicies", "iam:listPolicyVersions", "iam:listRolePolicies", "iam:listRoles", "iam:listSAMLProviders", "iam:listSSHPublicKeys", "iam:listServerCertificates", "iam:listSigningCertificates", "iam:listUserPolicies", "iam:listUsers", "iam:listVirtualMFADevices", "kafka:describeCluster", "kafka:describeClusterOperation", "kafka:describeClusterOperationV2", "kafka:describeClusterV2", "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", "kafka:listClientVpcConnections", "kafka:listClusterOperations", "kafka:listClusterOperationsV2", "kafka:listClusters", "kafka:listClustersV2", "kafka:listConfigurationRevisions", "kafka:listConfigurations", "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", "kafkaconnect:describeWorkerConfiguration", "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", "lambda:getFunctionConcurrency", "lambda:getFunctionConfiguration", "lambda:getFunctionEventInvokeConfig", "lambda:getFunctionUrlConfig", "lambda:getLayerVersion", "lambda:getLayerVersionPolicy", "lambda:getPolicy", "lambda:getProvisionedConcurrencyConfig", "lambda:getRuntimeManagementConfig", "lambda:listAliases", "lambda:listCodeSigningConfigs", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctionUrlConfigs", "lambda:listFunctions", "lambda:listFunctionsByCodeSigningConfig", "lambda:listLayerVersions", "lambda:listLayers", "lambda:listProvisionedConcurrencyConfigs", "lambda:listVersionsByFunction", "logs:describeExportTasks", "logs:describeLogGroups", "logs:describeLogStreams", "logs:describeMetricFilters", "logs:describeSubscriptionFilters", "medialive:listChannels", "medialive:listInputSecurityGroups", "medialive:listInputs", "mobiletargeting:getAdmChannel", "mobiletargeting:getApnsChannel", "mobiletargeting:getApnsSandboxChannel", "mobiletargeting:getApnsVoipChannel", "mobiletargeting:getApnsVoipSandboxChannel", "mobiletargeting:getApplicationSettings", "mobiletargeting:getApps", "mobiletargeting:getBaiduChannel", "mobiletargeting:getCampaign", "mobiletargeting:getCampaignActivities", "mobiletargeting:getCampaignVersions", "mobiletargeting:getCampaigns", "mobiletargeting:getEmailChannel", "mobiletargeting:getEventStream", "mobiletargeting:getExportJobs", "mobiletargeting:getGcmChannel", "mobiletargeting:getImportJobs", "mobiletargeting:getJourney", "mobiletargeting:getJourneyExecutionActivityMetrics", "mobiletargeting:getJourneyExecutionMetrics", "mobiletargeting:getJourneyRunExecutionActivityMetrics", "mobiletargeting:getJourneyRunExecutionMetrics", "mobiletargeting:getJourneyRuns", "mobiletargeting:getSegment", "mobiletargeting:getSegmentImportJobs", "mobiletargeting:getSegmentVersions", "mobiletargeting:getSegments", "mobiletargeting:getSmsChannel", "mobiletargeting:listJourneys", "pipes:listPipes", "polly:describeVoices", "polly:listLexicons", "quicksight:describeAccountCustomization", "quicksight:describeAccountSettings", "quicksight:describeAccountSubscription", "quicksight:describeAnalysis", "quicksight:describeAnalysisPermissions", "quicksight:describeDashboard", "quicksight:describeDashboardPermissions", "quicksight:describeDataSet", "quicksight:describeDataSetRefreshProperties", "quicksight:describeDataSource", "quicksight:describeFolder", "quicksight:describeFolderPermissions", "quicksight:describeFolderResolvedPermissions", "quicksight:describeGroup", "quicksight:describeGroupMembership", "quicksight:describeIAMPolicyAssignment", "quicksight:describeIngestion", "quicksight:describeIpRestriction", "quicksight:describeNamespace", "quicksight:describeRefreshSchedule", "quicksight:describeTemplate", "quicksight:describeTemplateAlias", "quicksight:describeTemplatePermissions", "quicksight:describeTheme", "quicksight:describeThemeAlias", "quicksight:describeThemePermissions", "quicksight:describeTopic", "quicksight:describeTopicRefresh", "quicksight:describeTopicRefreshSchedule", "quicksight:describeUser", "quicksight:describeVPCConnection", "quicksight:listAnalyses", "quicksight:listDashboardVersions", "quicksight:listDashboards", "quicksight:listDataSets", "quicksight:listDataSources", "quicksight:listFolderMembers", "quicksight:listFolders", "quicksight:listGroupMemberships", "quicksight:listGroups", "quicksight:listIAMPolicyAssignments", "quicksight:listIAMPolicyAssignmentsForUser", "quicksight:listIngestions", "quicksight:listNamespaces", "quicksight:listRefreshSchedules", "quicksight:listTemplateAliases", "quicksight:listTemplateVersions", "quicksight:listTemplates", "quicksight:listThemeAliases", "quicksight:listThemeVersions", "quicksight:listThemes", "quicksight:listTopicRefreshSchedules", "quicksight:listTopics", "quicksight:listUserGroups", "quicksight:listUsers", "quicksight:listVPCConnections", "quicksight:searchAnalyses", "quicksight:searchDashboards", "quicksight:searchDataSets", "quicksight:searchDataSources", "quicksight:searchFolders", "quicksight:searchGroups", "rds:describeAccountAttributes", "rds:describeBlueGreenDeployments", "rds:describeCertificates", "rds:describeDBClusterEndpoints", "rds:describeDBClusterParameterGroups", "rds:describeDBClusterParameters", "rds:describeDBClusterSnapshots", "rds:describeDBClusters", "rds:describeDBEngineVersions", "rds:describeDBInstanceAutomatedBackups", "rds:describeDBInstances", "rds:describeDBLogFiles", "rds:describeDBParameterGroups", "rds:describeDBParameters", "rds:describeDBSecurityGroups", "rds:describeDBSnapshotAttributes", "rds:describeDBSnapshots", "rds:describeDBSubnetGroups", "rds:describeEngineDefaultClusterParameters", "rds:describeEngineDefaultParameters", "rds:describeEventCategories", "rds:describeEventSubscriptions", "rds:describeEvents", "rds:describeExportTasks", "rds:describeGlobalClusters", "rds:describeIntegrations", "rds:describeOptionGroupOptions", "rds:describeOptionGroups", "rds:describeOrderableDBInstanceOptions", "rds:describePendingMaintenanceActions", "rds:describeReservedDBInstances", "rds:describeReservedDBInstancesOfferings", "rds:describeSourceRegions", "rds:describeValidDBInstanceModifications", "rds:listTagsForResource", "redshift-data:describeStatement", "redshift-data:listStatements", "redshift-serverless:getEndpointAccess", "redshift-serverless:getNamespace", "redshift-serverless:getRecoveryPoint", "redshift-serverless:getSnapshot", "redshift-serverless:getTableRestoreStatus", "redshift-serverless:getUsageLimit", "redshift-serverless:getWorkgroup", "redshift-serverless:listEndpointAccess", "redshift-serverless:listNamespaces", "redshift-serverless:listRecoveryPoints", "redshift-serverless:listSnapshots", "redshift-serverless:listTableRestoreStatus", "redshift-serverless:listUsageLimits", "redshift-serverless:listWorkgroups", "redshift:describeClusterParameterGroups", "redshift:describeClusterParameters", "redshift:describeClusterSecurityGroups", "redshift:describeClusterSnapshots", "redshift:describeClusterSubnetGroups", "redshift:describeClusterVersions", "redshift:describeClusters", "redshift:describeDataShares", "redshift:describeDataSharesForConsumer", "redshift:describeDataSharesForProducer", "redshift:describeDefaultClusterParameters", "redshift:describeEventCategories", "redshift:describeEventSubscriptions", "redshift:describeEvents", "redshift:describeHsmClientCertificates", "redshift:describeHsmConfigurations", "redshift:describeLoggingStatus", "redshift:describeOrderableClusterOptions", "redshift:describeReservedNodeOfferings", "redshift:describeReservedNodes", "redshift:describeResize", "redshift:describeSnapshotCopyGrants", "redshift:describeStorage", "redshift:describeTableRestoreStatus", "redshift:describeTags", "route53-recovery-cluster:getRoutingControlState", "route53-recovery-cluster:listRoutingControls", "route53-recovery-control-config:describeControlPanel", "route53-recovery-control-config:describeRoutingControl", "route53-recovery-control-config:describeSafetyRule", "route53-recovery-control-config:listControlPanels", "route53-recovery-control-config:listRoutingControls", "route53-recovery-control-config:listSafetyRules", "route53-recovery-readiness:getCell", "route53-recovery-readiness:getCellReadinessSummary", "route53-recovery-readiness:getReadinessCheck", "route53-recovery-readiness:getReadinessCheckResourceStatus", "route53-recovery-readiness:getReadinessCheckStatus", "route53-recovery-readiness:getRecoveryGroup", "route53-recovery-readiness:getRecoveryGroupReadinessSummary", "route53-recovery-readiness:listCells", "route53-recovery-readiness:listReadinessChecks", "route53-recovery-readiness:listRecoveryGroups", "route53-recovery-readiness:listResourceSets", "route53:getAccountLimit", "route53:getChange", "route53:getCheckerIpRanges", "route53:getDNSSEC", "route53:getGeoLocation", "route53:getHealthCheck", "route53:getHealthCheckCount", "route53:getHealthCheckLastFailureReason", "route53:getHealthCheckStatus", "route53:getHostedZone", "route53:getHostedZoneCount", "route53:getHostedZoneLimit", "route53:getQueryLoggingConfig", "route53:getReusableDelegationSet", "route53:getTrafficPolicy", "route53:getTrafficPolicyInstance", "route53:getTrafficPolicyInstanceCount", "route53:listCidrBlocks", "route53:listCidrCollections", "route53:listCidrLocations", "route53:listGeoLocations", "route53:listHealthChecks", "route53:listHostedZones", "route53:listHostedZonesByName", "route53:listHostedZonesByVpc", "route53:listQueryLoggingConfigs", "route53:listResourceRecordSets", "route53:listReusableDelegationSets", "route53:listTrafficPolicies", "route53:listTrafficPolicyInstances", "route53:listTrafficPolicyInstancesByHostedZone", "route53:listTrafficPolicyInstancesByPolicy", "route53:listTrafficPolicyVersions", "route53:listVPCAssociationAuthorizations", "route53domains:checkDomainAvailability", "route53domains:getContactReachabilityStatus", "route53domains:getDomainDetail", "route53domains:getOperationDetail", "route53domains:listDomains", "route53domains:listOperations", "route53domains:listPrices", "route53domains:listTagsForDomain", "route53domains:viewBilling", "route53resolver:getFirewallConfig", "route53resolver:getFirewallDomainList", "route53resolver:getFirewallRuleGroup", "route53resolver:getFirewallRuleGroupAssociation", "route53resolver:getFirewallRuleGroupPolicy", "route53resolver:getOutpostResolver", "route53resolver:getResolverDnssecConfig", "route53resolver:getResolverQueryLogConfig", "route53resolver:getResolverQueryLogConfigAssociation", "route53resolver:getResolverQueryLogConfigPolicy", "route53resolver:getResolverRule", "route53resolver:getResolverRuleAssociation", "route53resolver:getResolverRulePolicy", "route53resolver:listFirewallConfigs", "route53resolver:listFirewallDomainLists", "route53resolver:listFirewallDomains", "route53resolver:listFirewallRuleGroupAssociations", "route53resolver:listFirewallRuleGroups", "route53resolver:listFirewallRules", "route53resolver:listOutpostResolvers", "route53resolver:listResolverConfigs", "route53resolver:listResolverDnssecConfigs", "route53resolver:listResolverEndpointIpAddresses", "route53resolver:listResolverEndpoints", "route53resolver:listResolverQueryLogConfigAssociations", "route53resolver:listResolverQueryLogConfigs", "route53resolver:listResolverRuleAssociations", "route53resolver:listResolverRules", "route53resolver:listTagsForResource", "s3:describeJob", "s3:describeMultiRegionAccessPointOperation", "s3:getAccelerateConfiguration", "s3:getAccessPoint", "s3:getAccessPointConfigurationForObjectLambda", "s3:getAccessPointForObjectLambda", "s3:getAccessPointPolicy", "s3:getAccessPointPolicyForObjectLambda", "s3:getAccessPointPolicyStatus", "s3:getAccessPointPolicyStatusForObjectLambda", "s3:getAccountPublicAccessBlock", "s3:getAnalyticsConfiguration", "s3:getBucketAcl", "s3:getBucketCORS", "s3:getBucketLocation", "s3:getBucketLogging", "s3:getBucketNotification", "s3:getBucketObjectLockConfiguration", "s3:getBucketOwnershipControls", "s3:getBucketPolicy", "s3:getBucketPolicyStatus", "s3:getBucketPublicAccessBlock", "s3:getBucketRequestPayment", "s3:getBucketVersioning", "s3:getBucketWebsite", "s3:getEncryptionConfiguration", "s3:getIntelligentTieringConfiguration", "s3:getInventoryConfiguration", "s3:getLifecycleConfiguration", "s3:getMetricsConfiguration", "s3:getMultiRegionAccessPoint", "s3:getMultiRegionAccessPointPolicy", "s3:getMultiRegionAccessPointPolicyStatus", "s3:getMultiRegionAccessPointRoutes", "s3:getObjectLegalHold", "s3:getObjectRetention", "s3:getReplicationConfiguration", "s3:getStorageLensConfiguration", "s3:listAccessPoints", "s3:listAccessPointsForObjectLambda", "s3:listAllMyBuckets", "s3:listBucket", "s3:listBucketMultipartUploads", "s3:listBucketVersions", "s3:listJobs", "s3:listMultiRegionAccessPoints", "s3:listMultipartUploadParts", "s3:listStorageLensConfigurations", "s3express:getBucketPolicy", "s3express:listAllMyDirectoryBuckets", "sagemaker:describeAction", "sagemaker:describeAlgorithm", "sagemaker:describeApp", "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", "sagemaker:describeCluster", "sagemaker:describeClusterNode", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", "sagemaker:describeDeviceFleet", "sagemaker:describeDomain", "sagemaker:describeEdgeDeploymentPlan", "sagemaker:describeEdgePackagingJob", "sagemaker:describeEndpoint", "sagemaker:describeEndpointConfig", "sagemaker:describeExperiment", "sagemaker:describeFeatureGroup", "sagemaker:describeFeatureMetadata", "sagemaker:describeFlowDefinition", "sagemaker:describeHub", "sagemaker:describeHubContent", "sagemaker:describeHumanTaskUi", "sagemaker:describeHyperParameterTuningJob", "sagemaker:describeImage", "sagemaker:describeImageVersion", "sagemaker:describeInferenceComponent", "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", "sagemaker:describeModelCard", "sagemaker:describeModelCardExportJob", "sagemaker:describeModelExplainabilityJobDefinition", "sagemaker:describeModelPackage", "sagemaker:describeModelPackageGroup", "sagemaker:describeModelQualityJobDefinition", "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describeProcessingJob", "sagemaker:describeProject", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", "sagemaker:describeUserProfile", "sagemaker:describeWorkforce", "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", "sagemaker:listAliases", "sagemaker:listAppImageConfigs", "sagemaker:listApps", "sagemaker:listArtifacts", "sagemaker:listAssociations", "sagemaker:listAutoMLJobs", "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", "sagemaker:listDevices", "sagemaker:listDomains", "sagemaker:listEdgeDeploymentPlans", "sagemaker:listEdgePackagingJobs", "sagemaker:listEndpointConfigs", "sagemaker:listEndpoints", "sagemaker:listExperiments", "sagemaker:listFeatureGroups", "sagemaker:listFlowDefinitions", "sagemaker:listHubContentVersions", "sagemaker:listHubContents", "sagemaker:listHubs", "sagemaker:listHumanTaskUis", "sagemaker:listHyperParameterTuningJobs", "sagemaker:listImageVersions", "sagemaker:listImages", "sagemaker:listInferenceComponents", "sagemaker:listInferenceExperiments", "sagemaker:listInferenceRecommendationsJobSteps", "sagemaker:listInferenceRecommendationsJobs", "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", "sagemaker:listModelCardVersions", "sagemaker:listModelCards", "sagemaker:listModelExplainabilityJobDefinitions", "sagemaker:listModelMetadata", "sagemaker:listModelPackageGroups", "sagemaker:listModelPackages", "sagemaker:listModelQualityJobDefinitions", "sagemaker:listModels", "sagemaker:listMonitoringAlertHistory", "sagemaker:listMonitoringAlerts", "sagemaker:listMonitoringExecutions", "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", "sagemaker:listProcessingJobs", "sagemaker:listProjects", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", "sagemaker:listSubscribedWorkteams", "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", "sagemaker:listWorkforces", "sagemaker:listWorkteams", "scheduler:listScheduleGroups", "scheduler:listSchedules", "servicequotas:listAWSDefaultServiceQuotas", "servicequotas:listServiceQuotas", "ses:describeActiveReceiptRuleSet", "ses:describeConfigurationSet", "ses:describeReceiptRule", "ses:describeReceiptRuleSet", "ses:getAccount", "ses:getAccountSendingEnabled", "ses:getBlacklistReports", "ses:getConfigurationSet", "ses:getConfigurationSetEventDestinations", "ses:getContactList", "ses:getDedicatedIp", "ses:getDedicatedIpPool", "ses:getDedicatedIps", "ses:getDeliverabilityDashboardOptions", "ses:getDeliverabilityTestReport", "ses:getDomainDeliverabilityCampaign", "ses:getDomainStatisticsReport", "ses:getEmailIdentity", "ses:getIdentityDkimAttributes", "ses:getIdentityMailFromDomainAttributes", "ses:getIdentityNotificationAttributes", "ses:getIdentityPolicies", "ses:getIdentityVerificationAttributes", "ses:getImportJob", "ses:getSendQuota", "ses:getSendStatistics", "ses:listConfigurationSets", "ses:listContactLists", "ses:listContacts", "ses:listCustomVerificationEmailTemplates", "ses:listDedicatedIpPools", "ses:listDeliverabilityTestReports", "ses:listDomainDeliverabilityCampaigns", "ses:listEmailIdentities", "ses:listEmailTemplates", "ses:listIdentities", "ses:listIdentityPolicies", "ses:listImportJobs", "ses:listReceiptFilters", "ses:listReceiptRuleSets", "ses:listRecommendations", "ses:listTagsForResource", "ses:listTemplates", "ses:listVerifiedEmailAddresses", "sns:checkIfPhoneNumberIsOptedOut", "sns:getDataProtectionPolicy", "sns:getEndpointAttributes", "sns:getPlatformApplicationAttributes", "sns:getSMSAttributes", "sns:getSMSSandboxAccountStatus", "sns:getSubscriptionAttributes", "sns:getTopicAttributes", "sns:listEndpointsByPlatformApplication", "sns:listOriginationNumbers", "sns:listPhoneNumbersOptedOut", "sns:listPlatformApplications", "sns:listSMSSandboxPhoneNumbers", "sns:listSubscriptions", "sns:listSubscriptionsByTopic", "sns:listTopics", "ssm-contacts:describeEngagement", "ssm-contacts:describePage", "ssm-contacts:getContact", "ssm-contacts:getContactChannel", "ssm-contacts:getContactPolicy", "ssm-contacts:getRotation", "ssm-contacts:getRotationOverride", "ssm-contacts:listContactChannels", "ssm-contacts:listContacts", "ssm-contacts:listEngagements", "ssm-contacts:listPageReceipts", "ssm-contacts:listPageResolutions", "ssm-contacts:listPagesByContact", "ssm-contacts:listPagesByEngagement", "ssm-contacts:listPreviewRotationShifts", "ssm-contacts:listRotationOverrides", "ssm-contacts:listRotationShifts", "ssm-contacts:listRotations", "ssm-incidents:getIncidentRecord", "ssm-incidents:getReplicationSet", "ssm-incidents:getResourcePolicies", "ssm-incidents:getResponsePlan", "ssm-incidents:getTimelineEvent", "ssm-incidents:listIncidentRecords", "ssm-incidents:listRelatedItems", "ssm-incidents:listReplicationSets", "ssm-incidents:listResponsePlans", "ssm-incidents:listTimelineEvents", "ssm-sap:getApplication", "ssm-sap:getComponent", "ssm-sap:getDatabase", "ssm-sap:getOperation", "ssm-sap:getResourcePermission", "ssm-sap:listApplications", "ssm-sap:listComponents", "ssm-sap:listDatabases", "ssm-sap:listOperations", "ssm:describeActivations", "ssm:describeAssociation", "ssm:describeAssociationExecutionTargets", "ssm:describeAssociationExecutions", "ssm:describeAutomationExecutions", "ssm:describeAutomationStepExecutions", "ssm:describeAvailablePatches", "ssm:describeDocument", "ssm:describeDocumentPermission", "ssm:describeEffectiveInstanceAssociations", "ssm:describeEffectivePatchesForPatchBaseline", "ssm:describeInstanceAssociationsStatus", "ssm:describeInstanceInformation", "ssm:describeInstancePatchStates", "ssm:describeInstancePatchStatesForPatchGroup", "ssm:describeInstancePatches", "ssm:describeInventoryDeletions", "ssm:describeMaintenanceWindowExecutionTaskInvocations", "ssm:describeMaintenanceWindowExecutionTasks", "ssm:describeMaintenanceWindowExecutions", "ssm:describeMaintenanceWindowSchedule", "ssm:describeMaintenanceWindowTargets", "ssm:describeMaintenanceWindowTasks", "ssm:describeMaintenanceWindows", "ssm:describeMaintenanceWindowsForTarget", "ssm:describeOpsItems", "ssm:describeParameters", "ssm:describePatchBaselines", "ssm:describePatchGroupState", "ssm:describePatchGroups", "ssm:describePatchProperties", "ssm:describeSessions", "ssm:getAutomationExecution", "ssm:getCalendarState", "ssm:getCommandInvocation", "ssm:getConnectionStatus", "ssm:getDefaultPatchBaseline", "ssm:getDeployablePatchSnapshotForInstance", "ssm:getInventorySchema", "ssm:getMaintenanceWindow", "ssm:getMaintenanceWindowExecution", "ssm:getMaintenanceWindowExecutionTask", "ssm:getMaintenanceWindowExecutionTaskInvocation", "ssm:getMaintenanceWindowTask", "ssm:getOpsItem", "ssm:getOpsMetadata", "ssm:getOpsSummary", "ssm:getPatchBaseline", "ssm:getPatchBaselineForPatchGroup", "ssm:getResourcePolicies", "ssm:getServiceSetting", "ssm:listAssociationVersions", "ssm:listAssociations", "ssm:listCommandInvocations", "ssm:listCommands", "ssm:listComplianceItems", "ssm:listComplianceSummaries", "ssm:listDocumentMetadataHistory", "ssm:listDocumentVersions", "ssm:listDocuments", "ssm:listOpsItemEvents", "ssm:listOpsItemRelatedItems", "ssm:listOpsMetadata", "ssm:listResourceComplianceSummaries", "ssm:listResourceDataSync", "ssm:listTagsForResource", "swf:describeActivityType", "swf:describeDomain", "swf:describeWorkflowExecution", "swf:describeWorkflowType", "swf:getWorkflowExecutionHistory", "swf:listActivityTypes", "swf:listClosedWorkflowExecutions", "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", "vpc-lattice:getListener", "vpc-lattice:getResourcePolicy", "vpc-lattice:getRule", "vpc-lattice:getService", "vpc-lattice:getServiceNetwork", "vpc-lattice:getServiceNetworkServiceAssociation", "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", "vpc-lattice:listListeners", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", "waf-regional:getByteMatchSet", "waf-regional:getChangeTokenStatus", "waf-regional:getGeoMatchSet", "waf-regional:getIPSet", "waf-regional:getLoggingConfiguration", "waf-regional:getRateBasedRule", "waf-regional:getRegexMatchSet", "waf-regional:getRegexPatternSet", "waf-regional:getRule", "waf-regional:getRuleGroup", "waf-regional:getSqlInjectionMatchSet", "waf-regional:getWebACL", "waf-regional:getWebACLForResource", "waf-regional:listActivatedRulesInRuleGroup", "waf-regional:listByteMatchSets", "waf-regional:listGeoMatchSets", "waf-regional:listIPSets", "waf-regional:listLoggingConfigurations", "waf-regional:listRateBasedRules", "waf-regional:listRegexMatchSets", "waf-regional:listRegexPatternSets", "waf-regional:listResourcesForWebACL", "waf-regional:listRuleGroups", "waf-regional:listRules", "waf-regional:listSqlInjectionMatchSets", "waf-regional:listWebACLs", "waf:getByteMatchSet", "waf:getChangeTokenStatus", "waf:getGeoMatchSet", "waf:getIPSet", "waf:getLoggingConfiguration", "waf:getRateBasedRule", "waf:getRegexMatchSet", "waf:getRegexPatternSet", "waf:getRule", "waf:getRuleGroup", "waf:getSampledRequests", "waf:getSizeConstraintSet", "waf:getSqlInjectionMatchSet", "waf:getWebACL", "waf:getXssMatchSet", "waf:listActivatedRulesInRuleGroup", "waf:listByteMatchSets", "waf:listGeoMatchSets", "waf:listIPSets", "waf:listLoggingConfigurations", "waf:listRateBasedRules", "waf:listRegexMatchSets", "waf:listRegexPatternSets", "waf:listRuleGroups", "waf:listRules", "waf:listSizeConstraintSets", "waf:listSqlInjectionMatchSets", "waf:listWebACLs", "waf:listXssMatchSets", "wafv2:checkCapacity", "wafv2:describeManagedRuleGroup", "wafv2:getIPSet", "wafv2:getLoggingConfiguration", "wafv2:getPermissionPolicy", "wafv2:getRateBasedStatementManagedKeys", "wafv2:getRegexPatternSet", "wafv2:getRuleGroup", "wafv2:getSampledRequests", "wafv2:getWebACL", "wafv2:getWebACLForResource", "wafv2:listAvailableManagedRuleGroups", "wafv2:listIPSets", "wafv2:listLoggingConfigurations", "wafv2:listRegexPatternSets", "wafv2:listResourcesForWebACL", "wafv2:listRuleGroups", "wafv2:listTagsForResource", "wafv2:listWebACLs", "workspaces-web:getBrowserSettings", "workspaces-web:getIdentityProvider", "workspaces-web:getNetworkSettings", "workspaces-web:getPortal", "workspaces-web:getPortalServiceProviderMetadata", "workspaces-web:getTrustStoreCertificate", "workspaces-web:getUserSettings", "workspaces-web:listBrowserSettings", "workspaces-web:listIdentityProviders", "workspaces-web:listNetworkSettings", "workspaces-web:listPortals", "workspaces-web:listTagsForResource", "workspaces-web:listTrustStoreCertificates", "workspaces-web:listTrustStores", "workspaces-web:listUserSettings", "workspaces:describeAccount", "workspaces:describeAccountModifications", "workspaces:describeApplicationAssociations", "workspaces:describeIpGroups", "workspaces:describeTags", "workspaces:describeWorkspaceAssociations", "workspaces:describeWorkspaceBundles", "workspaces:describeWorkspaceDirectories", "workspaces:describeWorkspaceImages", "workspaces:describeWorkspaces", "workspaces:describeWorkspacesConnectionStatus" ], "Resource": [ "*" ] } ], "Version": "2012-10-17" } } }, "createdDate": "2024-11-22T20:06:06.000Z", "lastUpdatedDate": "2024-11-22T20:06:06.000Z" }, "AWSObservabilityAdminServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-27T19:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListChildren", "organizations:ListParents", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "config:PutServiceLinkedConfigurationRecorder", "config:DeleteServiceLinkedConfigurationRecorder" ], "Resource": [ "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin/*" ] }, { "Effect": "Allow", "Action": [ "config:PutConfigurationAggregator", "config:DeleteConfigurationAggregator", "config:SelectAggregateResourceConfig" ], "Resource": [ "arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/observabilityadmin.amazonaws.com/*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "config.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "config.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "config.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "observabilityadmin.amazonaws.com", "config.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-11-27T19:36:07.000Z", "lastUpdatedDate": "2024-11-27T19:36:07.000Z" }, "SageMakerStudioFullAccess": { "arn": "arn:aws:iam::aws:policy/SageMakerStudioFullAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-11-28T00:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets", "iam:ListUsers", "glue:GetDatabases", "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codewhisperer:ListProfiles", "bedrock:ListInferenceProfiles", "bedrock:ListFoundationModels", "bedrock:ListTagsForResource", "aoss:ListSecurityPolicies" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid": "ConfigureBucketStatement", "Effect": "Allow", "Action": [ "s3:PutBucketCORS", "s3:PutBucketPolicy", "s3:PutBucketVersioning" ], "Resource": [ "arn:aws:s3:::amazon-sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonSageMaker*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "IAMGetPolicyStatement", "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid": "DataZoneTagOnCreateDomainProjectTags", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "ConnectionStatement", "Effect": "Allow", "Action": [ "codeconnections:GetConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "TagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:TagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "for-use-with-all-datazone-projects" ] }, "StringEquals": { "aws:RequestTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "UntagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UntagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "for-use-with-all-datazone-projects" } } }, { "Sid": "SSMParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*", "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" ] }, { "Sid": "UseKMSKeyPermissionsStatement", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "true" }, "Null": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "false" }, "StringLike": { "kms:ViaService": "ssm.*.amazonaws.com" } } }, { "Sid": "SecurityPolicyStatement", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetFoundationModelStatement", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid": "GetInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Sid": "ApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:RequestTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "TagApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:TagResource" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "DeleteApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:DeleteInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false" } } } ] } }, "v2": { "createdDate": "2024-11-28T00:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonDataZoneStatement", "Effect": "Allow", "Action": [ "datazone:*" ], "Resource": [ "*" ] }, { "Sid": "ReadOnlyStatement", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets", "iam:ListUsers", "glue:GetDatabases", "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codewhisperer:ListProfiles", "bedrock:ListInferenceProfiles", "bedrock:ListFoundationModels", "bedrock:ListTagsForResource", "aoss:ListSecurityPolicies" ], "Resource": [ "*" ] }, { "Sid": "BucketReadOnlyStatement", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "CreateBucketStatement", "Effect": "Allow", "Action": [ "s3:CreateBucket" ], "Resource": [ "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid": "ConfigureBucketStatement", "Effect": "Allow", "Action": [ "s3:PutBucketCORS", "s3:PutBucketPolicy", "s3:PutBucketVersioning" ], "Resource": [ "arn:aws:s3:::amazon-sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "RamCreateResourceStatement", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringEqualsIfExists": { "ram:RequestedResourceType": "datazone:Domain" } } }, { "Sid": "RamResourceStatement", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource": "*", "Condition": { "StringLike": { "ram:ResourceShareName": [ "DataZone*" ] } } }, { "Sid": "RamResourceReadOnlyStatement", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource": "*" }, { "Sid": "IAMPassRoleStatement", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonSageMaker*" ], "Condition": { "StringEquals": { "iam:passedToService": "datazone.amazonaws.com" } } }, { "Sid": "IAMGetPolicyStatement", "Effect": "Allow", "Action": "iam:GetPolicy", "Resource": [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid": "DataZoneTagOnCreateDomainProjectTags", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "DataZoneTagOnCreate", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneDomain" ] }, "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*", "aws:ResourceTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "CreateSecretStatement", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition": { "StringLike": { "aws:RequestTag/AmazonDataZoneDomain": "dzd_*" } } }, { "Sid": "ConnectionStatement", "Effect": "Allow", "Action": [ "codeconnections:GetConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid": "TagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:TagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*", "arn:aws:codeconnections:*:*:host/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "for-use-with-all-datazone-projects" ] }, "StringEquals": { "aws:RequestTag/for-use-with-all-datazone-projects": "true" } } }, { "Sid": "UntagCodeConnectionsStatement", "Effect": "Allow", "Action": [ "codeconnections:UntagResource" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*", "arn:aws:codeconnections:*:*:host/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "for-use-with-all-datazone-projects" } } }, { "Sid": "SSMParameterStatement", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource": [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*", "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" ] }, { "Sid": "UseKMSKeyPermissionsStatement", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "true" }, "Null": { "aws:ResourceTag/EnableKeyForAmazonDataZone": "false" }, "StringLike": { "kms:ViaService": "ssm.*.amazonaws.com" } } }, { "Sid": "SecurityPolicyStatement", "Effect": "Allow", "Action": [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy" ], "Resource": [ "*" ], "Condition": { "StringLike": { "aoss:collection": "bedrock-ide-*" } } }, { "Sid": "GetFoundationModelStatement", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid": "GetInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Sid": "ApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:RequestTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "TagApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:TagResource" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:RequestTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false", "aws:RequestTag/AmazonDataZoneDomain": "false" } } }, { "Sid": "DeleteApplicationInferenceProfileStatement", "Effect": "Allow", "Action": [ "bedrock:DeleteInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "true", "aws:ResourceTag/AmazonDataZoneDomain": "false" } } } ] } } }, "createdDate": "2024-11-28T00:06:07.000Z", "lastUpdatedDate": "2025-01-21T22:52:06.000Z" }, "DeclarativePoliciesEC2Report": { "arn": "arn:aws:iam::aws:policy/aws-service-role/DeclarativePoliciesEC2Report", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-11-30T13:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DeclarativePoliciesEC2Report", "Effect": "Allow", "Action": [ "ec2:DescribeRegions", "ec2:GetSerialConsoleAccessStatus", "ec2:GetInstanceMetadataDefaults", "ec2:GetImageBlockPublicAccessState", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetAllowedImagesSettings", "ec2:DescribeVpcBlockPublicAccessOptions" ], "Resource": [ "*" ] } ] } } }, "createdDate": "2024-11-30T13:21:06.000Z", "lastUpdatedDate": "2024-11-30T13:21:06.000Z" }, "AWSSecurityIncidentResponseServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSecurityIncidentResponseServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T16:36:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityIncidentResponseOrganizationsPolicy", "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListChildren" ], "Resource": "*" }, { "Sid": "SecurityIncidentResponseCreateCasePolicyTagOnCreate", "Effect": "Allow", "Action": [ "security-ir:TagResource", "security-ir:CreateCase" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "SecurityIncidentResponseManaged" ] }, "StringEquals": { "aws:RequestTag/SecurityIncidentResponseManaged": "true", "aws:ResourceTag/SecurityIncidentResponseManaged": "true" } }, "Resource": "arn:aws:security-ir:*:*:case/*" } ] } } }, "createdDate": "2024-12-01T16:36:06.000Z", "lastUpdatedDate": "2024-12-01T16:36:06.000Z" }, "AWSSecurityIncidentResponseTriageServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSSecurityIncidentResponseTriageServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T16:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "events:DeleteRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": "*", "Condition": { "StringEquals": { "events:ManagedBy": "triage.security-ir.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "events:DescribeRule", "events:ListTargetsByRule" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "guardduty:ArchiveFindings", "guardduty:CreateFilter", "guardduty:DescribeMalwareScans", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetFindings", "guardduty:ListDetectors", "guardduty:StartMalwareScan", "guardduty:UpdateFindingsFeedback" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "securityhub:BatchUpdateFindings", "securityhub:DescribeHub", "securityhub:GetEnabledStandards", "securityhub:GetFindings", "securityhub:ListEnabledProductsForImport", "securityhub:UpdateFindings" ], "Resource": "arn:aws:securityhub:*:*:hub/default" }, { "Effect": "Allow", "Action": [ "security-ir:CreateCase", "security-ir:TagResource" ], "Condition": { "StringEquals": { "aws:RequestTag/SecurityIncidentResponseManaged": "true" } }, "Resource": "*" } ] } } }, "createdDate": "2024-12-01T16:36:07.000Z", "lastUpdatedDate": "2024-12-01T16:36:07.000Z" }, "CloudWatchOpenSearchDashboardsFullAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchOpenSearchDashboardsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T21:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchOpenSearchDashboardsIntegration", "Effect": "Allow", "Action": [ "logs:ListIntegrations", "logs:GetIntegration", "logs:DeleteIntegration", "logs:PutIntegration", "logs:DescribeLogGroups", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpensearchReadAPIs", "Effect": "Allow", "Action": [ "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsOpensearchCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService", "Condition": { "StringEquals": { "iam:AWSServiceName": "opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "iam:AWSServiceName": "observability.aoss.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsCollectionRequestAccess", "Effect": "Allow", "Action": [ "aoss:CreateCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsApplicationRequestAccess", "Effect": "Allow", "Action": [ "es:CreateApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/OpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsCollectionResourceAccess", "Effect": "Allow", "Action": [ "aoss:DeleteCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:UpdateApplication", "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateSecurityPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:DeleteSecurityPolicy", "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAPIAccessAll", "Effect": "Allow", "Action": [ "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsIndexPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:GetAccessPolicy", "aoss:CreateLifecyclePolicy", "aoss:DeleteLifecyclePolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:index": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsDQSRequestQueryAccess", "Effect": "Allow", "Action": [ "es:AddDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsStartDirectQueryAccess", "Effect": "Allow", "Action": [ "opensearch:StartDirectQuery", "opensearch:GetDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*" }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource", "es:DeleteDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "directquery.opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAossTagsAccess", "Effect": "Allow", "Action": [ "aoss:TagResource" ], "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsApplicationTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:application/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsDataSourceTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:datasource/*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } } ] } } }, "createdDate": "2024-12-01T21:06:07.000Z", "lastUpdatedDate": "2024-12-01T21:06:07.000Z" }, "CloudWatchOpenSearchDashboardAccess": { "arn": "arn:aws:iam::aws:policy/CloudWatchOpenSearchDashboardAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T21:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchOpenSearchDashboardsIntegration", "Effect": "Allow", "Action": [ "logs:ListIntegrations", "logs:GetIntegration", "logs:DescribeLogGroups", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpensearchReadAPIs", "Effect": "Allow", "Action": [ "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAPIAccessAll", "Effect": "Allow", "Action": [ "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsDQSCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy" ], "Resource": "*", "Condition": { "StringLike": { "aws:CalledViaFirst": "logs.amazonaws.com", "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsDirectQueryStatusAccess", "Effect": "Allow", "Action": [ "opensearch:GetDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*" } ] } } }, "createdDate": "2024-12-01T21:06:07.000Z", "lastUpdatedDate": "2024-12-01T21:06:07.000Z" }, "CloudWatchNetworkFlowMonitorServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchNetworkFlowMonitorServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T22:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/NetworkFlowMonitor" } } }, { "Effect": "Allow", "Action": [ "organizations:ListDelegatedAdministrators", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeAccount", "organizations:ListAccounts" ], "Resource": [ "arn:aws:organizations::*:account/*", "arn:aws:organizations::*:organization/*" ] } ] } } }, "createdDate": "2024-12-01T22:36:07.000Z", "lastUpdatedDate": "2024-12-01T22:36:07.000Z" }, "CloudWatchNetworkFlowMonitorAgentPublishPolicy": { "arn": "arn:aws:iam::aws:policy/CloudWatchNetworkFlowMonitorAgentPublishPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T22:51:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "networkflowmonitor:Publish" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-01T22:51:06.000Z", "lastUpdatedDate": "2024-12-01T22:51:06.000Z" }, "CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T22:51:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVpnConnections", "ec2:DescribeCustomerGateways", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-01T22:51:07.000Z", "lastUpdatedDate": "2024-12-01T22:51:07.000Z" }, "AWSSecurityIncidentResponseReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityIncidentResponseReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T23:06:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityIRReadAccess", "Effect": "Allow", "Action": [ "security-ir:BatchGetMemberAccountDetails", "security-ir:GetMembership", "security-ir:ListMemberships", "security-ir:GetCase", "security-ir:ListCases", "security-ir:GetCaseAttachmentDownloadUrl", "security-ir:ListComments", "security-ir:ListCaseEdits", "security-ir:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-01T23:06:06.000Z", "lastUpdatedDate": "2024-12-01T23:06:06.000Z" }, "AWSSecurityIncidentResponseCaseFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityIncidentResponseCaseFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T23:21:05.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityIRCaseReadAccess", "Effect": "Allow", "Action": [ "security-ir:GetCase", "security-ir:ListCases", "security-ir:GetCaseAttachmentDownloadUrl", "security-ir:ListComments", "security-ir:ListCaseEdits" ], "Resource": "*" }, { "Sid": "SecurityIRCaseTagReadAccess", "Effect": "Allow", "Action": [ "security-ir:ListTagsForResource" ], "Resource": "arn:aws:security-ir:*:*:case/*" }, { "Sid": "SecurityIRCaseWriteAccess", "Effect": "Allow", "Action": [ "security-ir:CreateCase", "security-ir:UpdateCase", "security-ir:CloseCase", "security-ir:UpdateCaseStatus", "security-ir:UpdateResolverType", "security-ir:GetCaseAttachmentUploadUrl", "security-ir:CreateCaseComment", "security-ir:UpdateCaseComment" ], "Resource": "*", "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } } }, { "Sid": "SecurityIRCaseTagWriteAccess", "Effect": "Allow", "Action": [ "security-ir:TagResource", "security-ir:UntagResource" ], "Resource": "arn:aws:security-ir:*:*:case/*", "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } } } ] } } }, "createdDate": "2024-12-01T23:21:05.000Z", "lastUpdatedDate": "2024-12-01T23:21:05.000Z" }, "AWSSecurityIncidentResponseFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSSecurityIncidentResponseFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-01T23:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecurityIRReadAccess", "Effect": "Allow", "Action": [ "security-ir:BatchGetMemberAccountDetails", "security-ir:GetMembership", "security-ir:ListMemberships", "security-ir:GetCase", "security-ir:ListCases", "security-ir:GetCaseAttachmentDownloadUrl", "security-ir:ListComments", "security-ir:ListCaseEdits", "security-ir:ListTagsForResource" ], "Resource": "*" }, { "Sid": "SecurityIRWriteAccess", "Effect": "Allow", "Action": [ "security-ir:CreateMembership", "security-ir:UpdateMembership", "security-ir:CancelMembership", "security-ir:CreateCase", "security-ir:UpdateCase", "security-ir:CloseCase", "security-ir:UpdateCaseStatus", "security-ir:UpdateResolverType", "security-ir:GetCaseAttachmentUploadUrl", "security-ir:CreateCaseComment", "security-ir:UpdateCaseComment", "security-ir:TagResource", "security-ir:UntagResource" ], "Resource": "*", "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } } }, { "Sid": "AllowCreationOfServiceLinkedRoleForSecurityIncidentResponse", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/security-ir.amazonaws.com/AWSServiceRoleForSecurityIncidentResponse" ], "Condition": { "StringLike": { "iam:AWSServiceName": "security-ir.amazonaws.com" } } }, { "Sid": "AllowCreationOfServiceLinkedRoleForSecurityIncidentResponseTriage", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/triage.security-ir.amazonaws.com/AWSServiceRoleForSecurityIncidentResponse_Triage" ], "Condition": { "StringLike": { "iam:AWSServiceName": "triage.security-ir.amazonaws.com" } } }, { "Sid": "OrganizationsPolicies", "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-01T23:21:06.000Z", "lastUpdatedDate": "2024-12-01T23:21:06.000Z" }, "AIOpsAssistantPolicy": { "arn": "arn:aws:iam::aws:policy/AIOpsAssistantPolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-12-02T16:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOPSServiceAccess", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:List*", "acm-pca:Describe*", "acm-pca:GetCertificate", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:List*", "acm:DescribeCertificate", "acm:GetAccountConfiguration", "airflow:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:List*", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:List*", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:List*", "appflow:Describe*", "appflow:List*", "application-autoscaling:Describe*", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:List*", "applicationinsights:Describe*", "applicationinsights:List*", "apprunner:Describe*", "apprunner:List*", "appstream:Describe*", "appstream:List*", "appsync:GetApiAssociation", "appsync:GetDomainName", "appsync:GetFunction", "appsync:GetResolver", "appsync:GetSourceApiAssociation", "appsync:List*", "aps:Describe*", "aps:List*", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:List*", "athena:GetCapacityAssignmentConfiguration", "athena:GetCapacityReservation", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAssessment", "auditmanager:List*", "autoscaling:Describe*", "backup-gateway:GetHypervisor", "backup-gateway:List*", "backup:Describe*", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:List*", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetDataSource", "bedrock:GetGuardrail", "bedrock:GetKnowledgeBase", "bedrock:List*", "budgets:Describe*", "budgets:List*", "ce:Describe*", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:List*", "chatbot:Describe*", "chatbot:GetMicrosoftTeamsChannelConfiguration", "chatbot:List*", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:List*", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:List*", "cloudformation:Describe*", "cloudformation:GetResource", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Describe*", "cloudfront:GetCachePolicy", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetContinuousDeploymentPolicy", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:GetFunction", "cloudfront:GetKeyGroup", "cloudfront:GetMonitoringSubscription", "cloudfront:GetOriginAccessControl", "cloudfront:GetOriginRequestPolicy", "cloudfront:GetPublicKey", "cloudfront:GetRealtimeLogConfig", "cloudfront:GetResponseHeadersPolicy", "cloudfront:List*", "cloudtrail:Describe*", "cloudtrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetQueryResults", "cloudtrail:GetResourcePolicy", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudtrail:StartQuery", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:GetDashboard", "cloudwatch:GetInsightRuleReport", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStream", "cloudwatch:GetService", "cloudwatch:GetServiceLevelObjective", "cloudwatch:List*", "codeartifact:Describe*", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:List*", "codebuild:BatchGetFleets", "codebuild:List*", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:GetApplication", "codedeploy:GetDeploymentConfig", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:List*", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetRepositoryLink", "codestar-connections:GetSyncConfiguration", "codestar-connections:List*", "codestar-notifications:Describe*", "codestar-notifications:List*", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:AdminListGroupsForUser", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetLogDeliveryConfiguration", "cognito-idp:GetUICustomization", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:GetWebACLForResource", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListTagsForResource", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:GetStoredQuery", "config:List*", "connect:Describe*", "connect:GetTaskTemplate", "connect:List*", "databrew:Describe*", "databrew:List*", "datapipeline:Describe*", "datapipeline:GetPipelineDefinition", "datapipeline:List*", "datasync:Describe*", "datasync:List*", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetStorageProfile", "deadline:List*", "detective:GetMembers", "detective:List*", "devicefarm:GetDevicePool", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:GetVPCEConfiguration", "devicefarm:List*", "devops-guru:Describe*", "devops-guru:GetResourceCollection", "devops-guru:List*", "dms:Describe*", "dms:List*", "ds:Describe*", "dynamodb:Describe*", "dynamodb:GetResourcePolicy", "dynamodb:List*", "ec2:Describe*", "ec2:GetAssociatedEnclaveCertificateIamRoles", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:GetVerifiedAccessEndpointPolicy", "ec2:GetVerifiedAccessGroupPolicy", "ec2:GetVerifiedAccessInstanceWebAcl", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ecr:Describe*", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elastic-inference:Describe*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "emr-containers:Describe*", "emr-containers:List*", "emr-serverless:GetApplication", "emr-serverless:List*", "es:Describe*", "es:List*", "events:Describe*", "events:List*", "evidently:GetExperiment", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:List*", "firehose:Describe*", "firehose:List*", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:List*", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:List*", "forecast:Describe*", "forecast:List*", "frauddetector:BatchGetVariable", "frauddetector:Describe*", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:List*", "fsx:Describe*", "gamelift:Describe*", "gamelift:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetDatabase", "glue:GetDatabases", "glue:GetJob", "glue:GetRegistry", "glue:GetSchema", "glue:GetSchemaVersion", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:List*", "glue:querySchemaVersionMetadata", "grafana:Describe*", "grafana:List*", "greengrass:Describe*", "greengrass:GetDeployment", "greengrass:List*", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:List*", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetIPSet", "guardduty:GetMalwareProtectionPlan", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:List*", "health:DescribeEvents", "health:DescribeEventDetails", "healthlake:Describe*", "healthlake:List*", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetUser", "iam:GetUserPolicy", "iam:ListOpenIDConnectProviders", "iam:ListServerCertificates", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:GetWorkflow", "imagebuilder:List*", "inspector2:List*", "inspector:Describe*", "inspector:List*", "internetmonitor:GetMonitor", "internetmonitor:List*", "iot:Describe*", "iot:GetPackage", "iot:GetPackageVersion", "iot:GetPolicy", "iot:GetThingShadow", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:GetV2LoggingOptions", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotevents:Describe*", "iotevents:List*", "iotfleethub:Describe*", "iotfleethub:List*", "iotsitewise:Describe*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:List*", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:List*", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:List*", "kafka:Describe*", "kafka:GetClusterPolicy", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:Describe*", "kendra:List*", "kinesis:Describe*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kms:DescribeKey", "kms:ListResourceTags", "kms:ListKeys", "lakeformation:Describe*", "lakeformation:GetLFTag", "lakeformation:GetResourceLFTags", "lakeformation:List*", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetFunctionRecursionConfig", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersion", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetRuntimeManagementConfig", "lambda:List*", "launchwizard:GetDeployment", "launchwizard:List*", "lex:Describe*", "lex:List*", "license-manager:GetLicense", "license-manager:List*", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:Describe*", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "logs:GetDelivery", "logs:GetDeliveryDestination", "logs:GetDeliveryDestinationPolicy", "logs:GetDeliverySource", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:GetQueryResults", "logs:List*", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:List*", "lookoutvision:Describe*", "lookoutvision:List*", "m2:GetApplication", "m2:GetEnvironment", "m2:List*", "macie2:GetAllowList", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsFilter", "macie2:GetMacieSession", "macie2:List*", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:Describe*", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:List*", "memorydb:Describe*", "memorydb:List*", "mobiletargeting:GetInAppTemplate", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:Describe*", "network-firewall:List*", "networkmanager:Describe*", "networkmanager:GetConnectAttachment", "networkmanager:GetConnectPeer", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:List*", "nimble:GetLaunchProfile", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:List*", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:List*", "omics:GetAnnotationStore", "omics:GetReferenceStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:List*", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:List*", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:List*", "personalize:Describe*", "personalize:List*", "pipes:Describe*", "pipes:List*", "proton:GetEnvironmentTemplate", "proton:GetServiceTemplate", "proton:List*", "qbusiness:GetApplication", "qbusiness:GetDataSource", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetWebExperience", "qbusiness:List*", "qldb:Describe*", "qldb:List*", "ram:GetPermission", "ram:List*", "rds:Describe*", "rds:List*", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:List*", "redshift:Describe*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetRoute", "refactor-spaces:List*", "rekognition:Describe*", "rekognition:List*", "resiliencehub:Describe*", "resiliencehub:List*", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:List*", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:List*", "robomaker:Describe*", "robomaker:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:List*", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:List*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:List*", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetOutpostResolver", "route53resolver:GetResolverConfig", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:List*", "rum:GetAppMonitor", "rum:List*", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:List*", "s3:GetAccelerateConfiguration", "s3:GetAccessGrant", "s3:GetAccessGrantsInstance", "s3:GetAccessGrantsLocation", "s3:GetAccessPoint", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAnalyticsConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "S3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetIntelligentTieringConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:List*", "sagemaker:Describe*", "sagemaker:List*", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:List*", "schemas:Describe*", "schemas:GetResourcePolicy", "schemas:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetSecurityControls", "securityhub:Describe*", "securityhub:GetConfigurationPolicy", "securityhub:GetConfigurationPolicyAssociation", "securityhub:GetEnabledStandards", "securityhub:GetFindingAggregator", "securityhub:GetInsights", "securityhub:List*", "securitylake:GetSubscriber", "securitylake:List*", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicequotas:GetServiceQuota", "ses:Describe*", "ses:GetAccount", "ses:GetAddonInstance", "ses:GetAddonSubscription", "ses:GetArchive", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetEmailTemplate", "ses:GetIngressPoint", "ses:GetRelay", "ses:GetRuleSet", "ses:GetTemplate", "ses:GetTrafficPolicy", "ses:List*", "shield:Describe*", "shield:List*", "signer:GetSigningProfile", "signer:List*", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:List*", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:List*", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResponsePlan", "ssm-incidents:List*", "ssm-sap:GetApplication", "ssm-sap:List*", "ssm:Describe*", "ssm:GetDefaultPatchBaseline", "ssm:GetDocument", "ssm:GetParameters", "ssm:GetPatchBaseline", "ssm:GetResourcePolicies", "ssm:List*", "sso-directory:SearchGroups", "sso-directory:SearchUsers", "sso:GetInlinePolicyForPermissionSet", "sso:GetManagedApplicationInstance", "sso:GetPermissionsBoundaryForPermissionSet", "sso:GetSharedSsoConfiguration", "sso:ListAccountAssignments", "sso:ListApplicationAssignments", "sso:ListApplications", "sso:ListCustomerManagedPolicyReferencesInPermissionSet", "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", "sso:ListTagsForResource", "states:Describe*", "states:List*", "synthetics:Describe*", "synthetics:GetCanary", "synthetics:GetGroup", "synthetics:List*", "tag:GetResources", "timestream:Describe*", "timestream:List*", "transfer:Describe*", "transfer:List*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:List*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:List*", "wafv2:GetIPSet", "wafv2:GetLoggingConfiguration", "wafv2:GetRegexPatternSet", "wafv2:GetRuleGroup", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:List*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:List*" ], "Resource": "*" }, { "Sid": "AIOPSS3AccessForAmplify", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectAcl" ], "Resource": [ "arn:aws:s3:::amplify", "arn:aws:s3:::cdk--assets--*" ], "Condition": { "StringEquals": { "aws:ViaAWSService": [ "amplify.amazonaws.com" ], "aws:PrincipalAccount": [ "${aws:ResourceAccount}" ] } } }, { "Sid": "AIOPSAPIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*" ] } ] } }, "v2": { "createdDate": "2024-12-02T16:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOPSServiceAccess", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:List*", "acm-pca:Describe*", "acm-pca:GetCertificate", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:List*", "acm:DescribeCertificate", "acm:GetAccountConfiguration", "airflow:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:List*", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:List*", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:List*", "appflow:Describe*", "appflow:List*", "application-autoscaling:Describe*", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:List*", "applicationinsights:Describe*", "applicationinsights:List*", "apprunner:Describe*", "apprunner:List*", "appstream:Describe*", "appstream:List*", "appsync:GetApiAssociation", "appsync:GetDataSource", "appsync:GetDomainName", "appsync:GetFunction", "appsync:GetGraphqlApi", "appsync:GetResolver", "appsync:GetSourceApiAssociation", "appsync:List*", "aps:Describe*", "aps:List*", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:List*", "athena:GetCapacityAssignmentConfiguration", "athena:GetCapacityReservation", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAssessment", "auditmanager:List*", "autoscaling:Describe*", "backup-gateway:GetHypervisor", "backup-gateway:List*", "backup:Describe*", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:List*", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetDataSource", "bedrock:GetGuardrail", "bedrock:GetKnowledgeBase", "bedrock:List*", "budgets:Describe*", "budgets:List*", "ce:Describe*", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:List*", "chatbot:Describe*", "chatbot:GetMicrosoftTeamsChannelConfiguration", "chatbot:List*", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:List*", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:List*", "cloudformation:Describe*", "cloudformation:GetResource", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Describe*", "cloudfront:GetCachePolicy", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetContinuousDeploymentPolicy", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:GetFunction", "cloudfront:GetKeyGroup", "cloudfront:GetMonitoringSubscription", "cloudfront:GetOriginAccessControl", "cloudfront:GetOriginRequestPolicy", "cloudfront:GetPublicKey", "cloudfront:GetRealtimeLogConfig", "cloudfront:GetResponseHeadersPolicy", "cloudfront:List*", "cloudtrail:Describe*", "cloudtrail:GetChannel", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetQueryResults", "cloudtrail:GetResourcePolicy", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudtrail:StartQuery", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:GetDashboard", "cloudwatch:GetInsightRuleReport", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStream", "cloudwatch:GetService", "cloudwatch:GetServiceLevelObjective", "cloudwatch:List*", "codeartifact:Describe*", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:List*", "codebuild:BatchGetFleets", "codebuild:List*", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:GetApplication", "codedeploy:GetDeploymentConfig", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:List*", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetRepositoryLink", "codestar-connections:GetSyncConfiguration", "codestar-connections:List*", "codestar-notifications:Describe*", "codestar-notifications:List*", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:AdminListGroupsForUser", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetLogDeliveryConfiguration", "cognito-idp:GetUICustomization", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:GetWebACLForResource", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListUsers", "cognito-idp:ListTagsForResource", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:GetStoredQuery", "config:List*", "connect:Describe*", "connect:GetTaskTemplate", "connect:List*", "databrew:Describe*", "databrew:List*", "datapipeline:Describe*", "datapipeline:GetPipelineDefinition", "datapipeline:List*", "datasync:Describe*", "datasync:List*", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetStorageProfile", "deadline:List*", "detective:GetMembers", "detective:List*", "devicefarm:GetDevicePool", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:GetVPCEConfiguration", "devicefarm:List*", "devops-guru:Describe*", "devops-guru:GetResourceCollection", "devops-guru:List*", "dms:Describe*", "dms:List*", "ds:Describe*", "dynamodb:Describe*", "dynamodb:GetResourcePolicy", "dynamodb:List*", "ec2:Describe*", "ec2:GetAssociatedEnclaveCertificateIamRoles", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:GetVerifiedAccessEndpointPolicy", "ec2:GetVerifiedAccessGroupPolicy", "ec2:GetVerifiedAccessInstanceWebAcl", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ecr:Describe*", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "emr-containers:Describe*", "emr-containers:List*", "emr-serverless:GetApplication", "emr-serverless:List*", "es:Describe*", "es:List*", "events:Describe*", "events:List*", "evidently:GetExperiment", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:List*", "firehose:Describe*", "firehose:List*", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:List*", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:List*", "forecast:Describe*", "forecast:List*", "frauddetector:BatchGetVariable", "frauddetector:Describe*", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:List*", "fsx:Describe*", "gamelift:Describe*", "gamelift:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetDatabase", "glue:GetDatabases", "glue:GetJob", "glue:GetRegistry", "glue:GetSchema", "glue:GetSchemaVersion", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:List*", "glue:querySchemaVersionMetadata", "grafana:Describe*", "grafana:List*", "greengrass:Describe*", "greengrass:GetDeployment", "greengrass:List*", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:List*", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetIPSet", "guardduty:GetMalwareProtectionPlan", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:List*", "health:DescribeEvents", "health:DescribeEventDetails", "healthlake:Describe*", "healthlake:List*", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:GetWorkflow", "imagebuilder:List*", "inspector2:List*", "inspector:Describe*", "inspector:List*", "internetmonitor:GetMonitor", "internetmonitor:List*", "iot:Describe*", "iot:GetPackage", "iot:GetPackageVersion", "iot:GetPolicy", "iot:GetThingShadow", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:GetV2LoggingOptions", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotevents:Describe*", "iotevents:List*", "iotfleethub:Describe*", "iotfleethub:List*", "iotsitewise:Describe*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:List*", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:List*", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:List*", "kafka:Describe*", "kafka:GetClusterPolicy", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:Describe*", "kendra:List*", "kinesis:Describe*", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kms:DescribeKey", "kms:ListResourceTags", "kms:ListKeys", "lakeformation:Describe*", "lakeformation:GetLFTag", "lakeformation:GetResourceLFTags", "lakeformation:List*", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetFunctionRecursionConfig", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersion", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetRuntimeManagementConfig", "lambda:List*", "launchwizard:GetDeployment", "launchwizard:List*", "lex:Describe*", "lex:List*", "license-manager:GetLicense", "license-manager:List*", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:Describe*", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "logs:GetDelivery", "logs:GetDeliveryDestination", "logs:GetDeliveryDestinationPolicy", "logs:GetDeliverySource", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:GetQueryResults", "logs:List*", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "lookoutmetrics:Describe*", "lookoutmetrics:List*", "lookoutvision:Describe*", "lookoutvision:List*", "m2:GetApplication", "m2:GetEnvironment", "m2:List*", "macie2:GetAllowList", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsFilter", "macie2:GetMacieSession", "macie2:List*", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:Describe*", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:List*", "memorydb:Describe*", "memorydb:List*", "mobiletargeting:GetInAppTemplate", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:Describe*", "network-firewall:List*", "networkmanager:Describe*", "networkmanager:GetConnectAttachment", "networkmanager:GetConnectPeer", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:List*", "nimble:GetLaunchProfile", "nimble:GetStreamingImage", "nimble:GetStudio", "nimble:GetStudioComponent", "nimble:List*", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:List*", "omics:GetAnnotationStore", "omics:GetReferenceStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:List*", "opsworks-cm:Describe*", "opsworks-cm:List*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:List*", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:List*", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:List*", "personalize:Describe*", "personalize:List*", "pipes:Describe*", "pipes:List*", "proton:GetEnvironmentTemplate", "proton:GetServiceTemplate", "proton:List*", "qbusiness:GetApplication", "qbusiness:GetDataSource", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetWebExperience", "qbusiness:List*", "qldb:Describe*", "qldb:List*", "ram:GetPermission", "ram:List*", "rds:Describe*", "rds:List*", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:List*", "redshift:Describe*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetRoute", "refactor-spaces:List*", "rekognition:Describe*", "rekognition:List*", "resiliencehub:Describe*", "resiliencehub:List*", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:List*", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:List*", "robomaker:Describe*", "robomaker:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:List*", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:List*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:List*", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetOutpostResolver", "route53resolver:GetResolverConfig", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:List*", "rum:GetAppMonitor", "rum:List*", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketPolicy", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:List*", "s3:GetAccelerateConfiguration", "s3:GetAccessGrant", "s3:GetAccessGrantsInstance", "s3:GetAccessGrantsLocation", "s3:GetAccessPoint", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAnalyticsConfiguration", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "S3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetIntelligentTieringConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:List*", "sagemaker:Describe*", "sagemaker:List*", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:List*", "schemas:Describe*", "schemas:GetResourcePolicy", "schemas:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetSecurityControls", "securityhub:Describe*", "securityhub:GetConfigurationPolicy", "securityhub:GetConfigurationPolicyAssociation", "securityhub:GetEnabledStandards", "securityhub:GetFindingAggregator", "securityhub:GetInsights", "securityhub:List*", "securitylake:GetSubscriber", "securitylake:List*", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicequotas:GetServiceQuota", "ses:Describe*", "ses:GetAccount", "ses:GetAddonInstance", "ses:GetAddonSubscription", "ses:GetArchive", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetEmailTemplate", "ses:GetIngressPoint", "ses:GetRelay", "ses:GetRuleSet", "ses:GetTemplate", "ses:GetTrafficPolicy", "ses:List*", "shield:Describe*", "shield:List*", "signer:GetSigningProfile", "signer:List*", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:List*", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:List*", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResponsePlan", "ssm-incidents:List*", "ssm-sap:GetApplication", "ssm-sap:List*", "ssm:Describe*", "ssm:GetDefaultPatchBaseline", "ssm:GetDocument", "ssm:GetParameters", "ssm:GetPatchBaseline", "ssm:GetResourcePolicies", "ssm:List*", "sso-directory:SearchGroups", "sso-directory:SearchUsers", "sso:GetInlinePolicyForPermissionSet", "sso:GetManagedApplicationInstance", "sso:GetPermissionsBoundaryForPermissionSet", "sso:GetSharedSsoConfiguration", "sso:ListAccountAssignments", "sso:ListApplicationAssignments", "sso:ListApplications", "sso:ListCustomerManagedPolicyReferencesInPermissionSet", "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", "sso:ListTagsForResource", "states:Describe*", "states:List*", "synthetics:Describe*", "synthetics:GetCanary", "synthetics:GetGroup", "synthetics:List*", "tag:GetResources", "timestream:Describe*", "timestream:List*", "transfer:Describe*", "transfer:List*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:List*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:List*", "wafv2:GetIPSet", "wafv2:GetLoggingConfiguration", "wafv2:GetRegexPatternSet", "wafv2:GetRuleGroup", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:List*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:List*" ], "Resource": "*" }, { "Sid": "AIOPSS3AccessForAmplify", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectAcl" ], "Resource": [ "arn:aws:s3:::amplify", "arn:aws:s3:::cdk--assets--*" ], "Condition": { "StringEquals": { "aws:ViaAWSService": [ "amplify.amazonaws.com" ], "aws:PrincipalAccount": [ "${aws:ResourceAccount}" ] } } }, { "Sid": "AIOPSAPIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*" ] } ] } } }, "createdDate": "2024-12-02T16:21:06.000Z", "lastUpdatedDate": "2025-04-03T22:22:06.000Z" }, "AIOpsConsoleAdminPolicy": { "arn": "arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-02T23:51:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOpsAdmin", "Effect": "Allow", "Action": [ "aiops:*" ], "Resource": "*" }, { "Sid": "OrganizationsAccess", "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganization" ], "Resource": "*" }, { "Sid": "SSOApplicationManagement", "Effect": "Allow", "Action": [ "sso:PutApplicationAccessScope", "sso:PutApplicationAssignmentConfiguration", "sso:PutApplicationGrant", "sso:PutApplicationAuthenticationMethod", "sso:DeleteApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaLast": "aiops.amazonaws.com", "aws:ResourceTag/ManagedByAmazonAIOperations": "true" } } }, { "Sid": "SSOApplicationTagManagement", "Effect": "Allow", "Action": [ "sso:CreateApplication", "sso:TagResource" ], "Resource": [ "arn:aws:sso:::instance/*", "arn:aws:sso::aws:applicationProvider/aiops" ], "Condition": { "StringEquals": { "aws:CalledViaLast": "aiops.amazonaws.com", "aws:RequestTag/ManagedByAmazonAIOperations": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "ManagedByAmazonAIOperations" ] } } }, { "Sid": "SSOTagManagement", "Effect": "Allow", "Action": [ "sso:TagResource" ], "Resource": "arn:aws:sso::*:application/*", "Condition": { "StringEquals": { "aws:CalledViaLast": "aiops.amazonaws.com", "aws:ResourceTag/ManagedByAmazonAIOperations": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "ManagedByAmazonAIOperations" ] } } }, { "Sid": "SSOManagementAccess", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "sso:ListApplications", "sso:ListInstances", "sso:DescribeRegisteredRegions", "sso:GetSharedSsoConfiguration", "sso:DescribeInstance", "sso:GetSSOStatus", "sso-directory:DescribeUsers" ], "Resource": "*" }, { "Sid": "AllowSTSContextSetting", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "IdentityPropagationAccess", "Effect": "Allow", "Action": [ "signin:ListTrustedIdentityPropagationApplicationsForConsole" ], "Resource": "*" }, { "Sid": "CloudtrailAccess", "Effect": "Allow", "Action": [ "cloudtrail:ListTrails", "cloudtrail:DescribeTrails", "cloudtrail:ListEventDataStores" ], "Resource": "*" }, { "Sid": "KMSAccess", "Effect": "Allow", "Action": [ "kms:ListAliases" ], "Resource": "*" }, { "Sid": "SSMIntegrationSecretsManagerAccess", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:PutResourcePolicy", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret" ], "Resource": "arn:aws:secretsmanager:*:*:secret:aws/ssm/3p/*" }, { "Sid": "SSMIntegrationAccess", "Effect": "Allow", "Action": [ "ssm:GetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:*:*:servicesetting/integrations/*" }, { "Sid": "SSMIntegrationCreatePolicy", "Effect": "Allow", "Action": [ "iam:CreatePolicy" ], "Resource": "arn:aws:iam::*:policy/service-role/AWSServiceRoleSSMIntegrationsPolicy*" }, { "Sid": "ChatbotConfigurations", "Effect": "Allow", "Action": [ "chatbot:DescribeChimeWebhookConfigurations", "chatbot:DescribeSlackWorkspaces", "chatbot:DescribeSlackChannelConfigurations", "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:ListMicrosoftTeamsConfiguredTeams" ], "Resource": "*" }, { "Sid": "IAMPassRoleToAIOps", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "aiops.amazonaws.com" } } }, { "Sid": "IAMListRoles", "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" }, { "Sid": "TagBoundaryPermission", "Effect": "Allow", "Action": [ "tag:GetTagKeys" ], "Resource": "*" }, { "Sid": "IAMPassRoleToSSMIntegration", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.integrations.amazonaws.com" }, "ArnEquals": { "iam:AssociatedResourceArn": "arn:aws:aiops:*:*:investigation-group/*" } } }, { "Sid": "SSMOpsItemAccess", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:AddTagsToResource" ], "Resource": "arn:*:ssm:*:*:opsitem/*", "Condition": { "StringEquals": { "aws:RequestTag/Integration": "CloudWatch", "aws:ResourceTag/Integration": "CloudWatch" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Integration" ] } } } ] } } }, "createdDate": "2024-12-02T23:51:06.000Z", "lastUpdatedDate": "2024-12-02T23:51:06.000Z" }, "AIOpsReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AIOpsReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-02T23:51:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOpsReadOnlyAccess", "Effect": "Allow", "Action": [ "aiops:Get*", "aiops:List*" ], "Resource": "*" }, { "Sid": "SSOManagementAccess", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "sso:DescribeInstance", "sso-directory:DescribeUsers" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-02T23:51:07.000Z", "lastUpdatedDate": "2024-12-02T23:51:07.000Z" }, "AIOpsOperatorAccess": { "arn": "arn:aws:iam::aws:policy/AIOpsOperatorAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-02T23:51:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOpsOperatorAccess", "Effect": "Allow", "Action": [ "aiops:CreateInvestigation", "aiops:CreateInvestigationEvent", "aiops:CreateInvestigationResource", "aiops:DeleteInvestigation", "aiops:Get*", "aiops:List*", "aiops:UpdateInvestigation", "aiops:UpdateInvestigationEvent" ], "Resource": "*" }, { "Sid": "SSOManagementAccess", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "sso:DescribeInstance", "sso-directory:DescribeUsers" ], "Resource": "*" }, { "Sid": "AllowSTSContextSetting", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" }, { "Sid": "SSMSettingServiceIntegration", "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "arn:aws:ssm:*:*:servicesetting/integrations/*" }, { "Sid": "SSMIntegrationTagAccess", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:CreateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/Integration": [ "CloudWatch" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "Integration" } } }, { "Sid": "SSMOpsItemIntegration", "Effect": "Allow", "Action": [ "ssm:DeleteOpsItem", "ssm:UpdateOpsItem" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/Integration": [ "CloudWatch" ] } } }, { "Sid": "SSMTagOperation", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": "arn:aws:ssm:*:*:opsitem/*", "Condition": { "StringEquals": { "aws:ResourceTag/Integration": [ "CloudWatch" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "Integration" } } }, { "Sid": "SSMOpsSummaryIntegration", "Effect": "Allow", "Action": [ "ssm:GetOpsSummary" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-02T23:51:07.000Z", "lastUpdatedDate": "2024-12-02T23:51:07.000Z" }, "AuroraDsqlServiceLinkedRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AuroraDsqlServiceLinkedRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/AuroraDSQL", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-12-03T15:06:07.000Z", "lastUpdatedDate": "2024-12-03T15:06:07.000Z" }, "AmazonS3TablesReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3TablesReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:21:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3tables:Get*", "s3tables:List*" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-03T15:21:06.000Z", "lastUpdatedDate": "2024-12-03T15:21:06.000Z" }, "AmazonAuroraDSQLReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAuroraDSQLReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:21:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DsqlReadOnlyPermissions", "Effect": "Allow", "Action": [ "dsql:GetCluster", "dsql:ListClusters", "dsql:ListTagsForResource" ], "Resource": "*" }, { "Sid": "RelatedServicesPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-03T15:21:07.000Z", "lastUpdatedDate": "2024-12-03T15:21:07.000Z" }, "AmazonS3TablesFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonS3TablesFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:21:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3tables:*" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-03T15:21:07.000Z", "lastUpdatedDate": "2024-12-03T15:21:07.000Z" }, "QBusinessQuicksightPluginPolicy": { "arn": "arn:aws:iam::aws:policy/QBusinessQuicksightPluginPolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:36:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "QBusinessToQuickSightPredictQAResultsInvocation", "Effect": "Allow", "Action": [ "quicksight:PredictQAResults" ], "Resource": [ "arn:aws:quicksight:*:*:topic/*", "arn:aws:quicksight:*:*:dashboard/*" ] } ] } } }, "createdDate": "2024-12-03T15:36:06.000Z", "lastUpdatedDate": "2024-12-03T15:36:06.000Z" }, "AmazonAuroraDSQLConsoleFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAuroraDSQLConsoleFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DsqlAllPermissions", "Effect": "Allow", "Action": [ "dsql:CreateCluster", "dsql:GetCluster", "dsql:UpdateCluster", "dsql:DeleteCluster", "dsql:ListClusters", "dsql:CreateMultiRegionClusters", "dsql:DeleteMultiRegionClusters", "dsql:TagResource", "dsql:UntagResource", "dsql:ListTagsForResource", "dsql:DbConnectAdmin", "dsql:DbConnect" ], "Resource": "*" }, { "Sid": "DsqlConsolePermissions", "Effect": "Allow", "Action": [ "tag:GetTagKeys", "tag:GetTagValues", "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "CreateDsqlServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "dsql.amazonaws.com" } } } ] } } }, "createdDate": "2024-12-03T15:36:07.000Z", "lastUpdatedDate": "2024-12-03T15:36:07.000Z" }, "AmazonAuroraDSQLFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonAuroraDSQLFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-03T15:36:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "DsqlAllPermissions", "Effect": "Allow", "Action": [ "dsql:CreateCluster", "dsql:GetCluster", "dsql:UpdateCluster", "dsql:DeleteCluster", "dsql:ListClusters", "dsql:CreateMultiRegionClusters", "dsql:DeleteMultiRegionClusters", "dsql:TagResource", "dsql:UntagResource", "dsql:ListTagsForResource", "dsql:DbConnectAdmin", "dsql:DbConnect" ], "Resource": "*" }, { "Sid": "RelatedServicesPermissions", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData" ], "Resource": "*" }, { "Sid": "CreateDsqlServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "dsql.amazonaws.com" } } } ] } } }, "createdDate": "2024-12-03T15:36:07.000Z", "lastUpdatedDate": "2024-12-03T15:36:07.000Z" }, "AmazonSageMakerTrainingPlanCreateAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerTrainingPlanCreateAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-04T13:21:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTrainingPlanPermissions", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingPlan", "sagemaker:CreateReservedCapacity" ], "Resource": [ "arn:aws:sagemaker:*:*:training-plan/*", "arn:aws:sagemaker:*:*:reserved-capacity/*" ] }, { "Sid": "AggTagsToTrainingPlanPermissions", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:training-plan/*", "arn:aws:sagemaker:*:*:reserved-capacity/*" ], "Condition": { "StringEquals": { "sagemaker:TaggingAction": [ "CreateTrainingPlan", "CreateReservedCapacity" ] } } }, { "Sid": "DescribeTrainingPlanPermissions", "Effect": "Allow", "Action": "sagemaker:DescribeTrainingPlan", "Resource": [ "arn:aws:sagemaker:*:*:training-plan/*" ] }, { "Sid": "NonResourceLevelTrainingPlanPermissions", "Effect": "Allow", "Action": [ "sagemaker:SearchTrainingPlanOfferings", "sagemaker:ListTrainingPlans" ], "Resource": "*" } ] } } }, "createdDate": "2024-12-04T13:21:07.000Z", "lastUpdatedDate": "2024-12-04T13:21:07.000Z" }, "AmazonSageMakerCanvasSMDataScienceAssistantAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerCanvasSMDataScienceAssistantAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2024-12-04T14:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerDataScienceAssistantAccess", "Effect": "Allow", "Action": [ "sagemaker-data-science-assistant:SendConversation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonQDeveloperAccess", "Effect": "Allow", "Action": [ "q:SendMessage" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2024-12-04T14:06:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerDataScienceAssistantAccess", "Effect": "Allow", "Action": [ "sagemaker-data-science-assistant:SendConversation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AmazonQDeveloperAccess", "Effect": "Allow", "Action": [ "q:SendMessage", "q:StartConversation" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2024-12-04T14:06:07.000Z", "lastUpdatedDate": "2025-01-13T22:52:07.000Z" }, "AWSPartnerCentralSellingResourceSnapshotJobExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/AWSPartnerCentralSellingResourceSnapshotJobExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-10T18:21:15.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "partnercentral:CreateResourceSnapshot" ], "Resource": [ "arn:aws:partnercentral:*::catalog/AWS/engagement/*", "arn:aws:partnercentral:*::catalog/Sandbox/engagement/*" ] }, { "Effect": "Allow", "Action": [ "partnercentral:GetOpportunity" ], "Resource": [ "arn:aws:partnercentral:*:*:catalog/AWS/opportunity/*", "arn:aws:partnercentral:*:*:catalog/Sandbox/opportunity/*" ] } ] } } }, "createdDate": "2024-12-10T18:21:15.000Z", "lastUpdatedDate": "2024-12-10T18:21:15.000Z" }, "AWSBackupServiceRolePolicyForIndexing": { "arn": "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForIndexing", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-17T18:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EBSReadOnlyPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Sid": "KMSReadOnlyPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "EBSDirectReadAPIPermissions", "Effect": "Allow", "Action": [ "ebs:ListSnapshotBlocks", "ebs:GetSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "KMSDataKeyForEC2Permissions", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-12-17T18:37:06.000Z", "lastUpdatedDate": "2024-12-17T18:37:06.000Z" }, "AWSBackupServiceRolePolicyForItemRestores": { "arn": "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForItemRestores", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2024-12-17T18:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "EBSReadOnlyPermissions", "Effect": "Allow", "Action": [ "ec2:DescribeSnapshots" ], "Resource": "*" }, { "Sid": "KMSReadOnlyPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*" }, { "Sid": "EBSDirectReadAPIPermissions", "Effect": "Allow", "Action": [ "ebs:ListSnapshotBlocks", "ebs:GetSnapshotBlock" ], "Resource": "arn:aws:ec2:*::snapshot/*" }, { "Sid": "S3ReadonlyPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket" ], "Resource": "arn:aws:s3:::*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3PermissionsForFileLevelRestore", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": "arn:aws:s3:::*/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KMSDataKeyForS3AndEC2Permissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com", "s3.*.amazonaws.com" ] } } } ] } } }, "createdDate": "2024-12-17T18:37:06.000Z", "lastUpdatedDate": "2024-12-17T18:37:06.000Z" }, "AWSManagedServices_SelfServiceReporting_ServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSManagedServices_SelfServiceReporting_ServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-01-08T21:22:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:DescribeAccount", "organizations:ListAccounts" ], "Resource": "*" } ] } } }, "createdDate": "2025-01-08T21:22:06.000Z", "lastUpdatedDate": "2025-01-08T21:22:06.000Z" }, "AmazonSageMakerPartnerAppsFullAccess": { "arn": "arn:aws:iam::aws:policy/AmazonSageMakerPartnerAppsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-01-17T18:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerPartnerListAppsPermission", "Effect": "Allow", "Action": "sagemaker:ListPartnerApps", "Resource": "*" }, { "Sid": "AmazonSageMakerPartnerAppsPermission", "Effect": "Allow", "Action": [ "sagemaker:CreatePartnerAppPresignedUrl", "sagemaker:DescribePartnerApp", "sagemaker:CallPartnerAppApi" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } }, "Resource": "arn:aws:sagemaker:*:*:partner-app/*" } ] } } }, "createdDate": "2025-01-17T18:37:06.000Z", "lastUpdatedDate": "2025-01-17T18:37:06.000Z" }, "SageMakerStudioQueryExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioQueryExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-01-31T19:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "GlueGetConnectionOnCatalog", "Effect": "Allow", "Action": [ "glue:GetConnection" ], "Resource": [ "arn:aws:glue:*:*:catalog" ] }, { "Sid": "GlueGetConnectionsForProject", "Effect": "Allow", "Action": [ "glue:GetConnection", "glue:GetConnections", "glue:GetTags" ], "Resource": "arn:aws:glue:*:*:connection/*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneProject": "false" } } }, { "Sid": "S3GetObjectForAthenaSpillBucket", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*/dzd_*/*/dev/sys/athena/*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" } } }, { "Sid": "S3ListBucketOwnershipCheckForAthenaSpillBucket", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::amazon-sagemaker-*" ], "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true" } } }, { "Sid": "InvokeFunctionPermissionsForAthenaCatalogLambda", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:PrincipalTag/SageMakerStudioQueryExecutionRole": "true", "aws:ResourceTag/federated_athena_datacatalog": "true" } } } ] } } }, "createdDate": "2025-01-31T19:52:07.000Z", "lastUpdatedDate": "2025-01-31T19:52:07.000Z" }, "SageMakerStudioEMRServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2025-01-31T19:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PassRoleToEMREC2InstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_${aws:PrincipalTag/AmazonDataZoneProject}_${aws:PrincipalTag/AmazonDataZoneEnvironment}", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" }, "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AmazonDataZoneEnvironment": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AllowGenerateDataKeyForEbsEncryption", "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowEMRForKMSManagement", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowEMRToListKmsAliases", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2025-01-31T19:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "PassRoleToEMREC2InstanceRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/datazone_emr_ec2_instance_role_${aws:PrincipalTag/AmazonDataZoneProject}_${aws:PrincipalTag/AmazonDataZoneEnvironment}", "Condition": { "StringLike": { "iam:PassedToService": "ec2.amazonaws.com" }, "StringNotEquals": { "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AmazonDataZoneEnvironment": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CreateInNetworkForSharedSubnet", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:RunInstances", "ec2:CreateFleet" ], "Resource": [ "*" ], "Condition": { "ArnLike": { "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}" } } }, { "Sid": "EMRKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AllowGenerateDataKeyForEbsEncryption", "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowEMRForKMSManagement", "Effect": "Allow", "Action": [ "kms:ListGrants", "kms:RevokeGrant", "kms:DescribeKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowEMRToListKmsAliases", "Effect": "Allow", "Action": "kms:ListAliases", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2025-01-31T19:52:07.000Z", "lastUpdatedDate": "2025-02-27T00:22:06.000Z" }, "AWSElementalMediaConnectReadOnlyAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaConnectReadOnlyAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-12T20:07:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconnect:ListBridges", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListGatewayInstances", "mediaconnect:ListGateways", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:DescribeBridge", "mediaconnect:DescribeFlow", "mediaconnect:DescribeFlowSourceMetadata", "mediaconnect:DescribeFlowSourceThumbnail", "mediaconnect:DescribeGateway", "mediaconnect:DescribeGatewayInstance", "mediaconnect:DescribeOffering", "mediaconnect:DescribeReservation", "mediaconnect:ListTagsForResource" ], "Resource": "*" } ] } } }, "createdDate": "2025-02-12T20:07:07.000Z", "lastUpdatedDate": "2025-02-12T20:07:07.000Z" }, "AWSElementalMediaConnectFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSElementalMediaConnectFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-12T20:07:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mediaconnect:*" ], "Resource": "*" } ] } } }, "createdDate": "2025-02-12T20:07:07.000Z", "lastUpdatedDate": "2025-02-12T20:07:07.000Z" }, "SageMakerStudioBedrockAgentServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockAgentServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-13T23:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockApplyGuardrailPermissions", "Effect": "Allow", "Action": "bedrock:ApplyGuardrail", "Resource": "arn:aws:bedrock:*:*:guardrail/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "LambdaInvokeFunctionInProjectPermissions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockRetrievePermissions", "Effect": "Allow", "Action": "bedrock:Retrieve", "Resource": "arn:aws:bedrock:*:*:knowledge-base/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "S3GetObjectPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectVersionAttributes", "s3:GetObjectAttributes" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "BedrockGuardrailKmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:bedrock:guardrail-id": "false" } } }, { "Sid": "S3KmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] } } }, "createdDate": "2025-02-13T23:37:06.000Z", "lastUpdatedDate": "2025-02-13T23:37:06.000Z" }, "SageMakerStudioBedrockChatAgentUserRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-13T23:52:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockGetAgentAliasPermissions", "Effect": "Allow", "Action": "bedrock:GetAgentAlias", "Resource": "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockInvokeAgentPermissions", "Effect": "Allow", "Action": "bedrock:InvokeAgent", "Resource": "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockGetAndListAgentMetadataPermissions", "Effect": "Allow", "Action": [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions" ], "Resource": "arn:aws:bedrock:*:*:agent/${aws:PrincipalTag/AgentId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "S3ListAppDefinitionPermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AppDefinitionPath": "" } } }, { "Sid": "S3GetAppDefinitionPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AppDefinitionPath": "" } } }, { "Sid": "S3ListDataSourcePermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/DataSourcePath": "" } } }, { "Sid": "S3GetDataSourcePermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/DataSourcePath": "" } } }, { "Sid": "BedrockAgentKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com", "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:agent/${aws:PrincipalTag/AgentId}" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3KmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] } } }, "createdDate": "2025-02-13T23:52:06.000Z", "lastUpdatedDate": "2025-02-13T23:52:06.000Z" }, "SageMakerStudioBedrockFlowServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFlowServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2025-02-14T00:07:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockPromptPermissions", "Effect": "Allow", "Action": "bedrock:GetPrompt", "Resource": "arn:aws:bedrock:*:*:prompt/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockKnowledgeBasePermissions", "Effect": "Allow", "Action": "bedrock:Retrieve", "Resource": "arn:aws:bedrock:*:*:knowledge-base/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockGuardrailPermissions", "Effect": "Allow", "Action": "bedrock:ApplyGuardrail", "Resource": "arn:aws:bedrock:*:*:guardrail/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "AllowLambdaInvokeFunctionInProjectPermissions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockApplicationInferenceProfileAccessInProjectPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockInvokeModelAccessWithInferenceProfilePermissions", "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockPromptKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com", "kms:EncryptionContext:aws:bedrock-prompts:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:prompt/*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } }, "v2": { "createdDate": "2025-02-14T00:07:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockPromptPermissions", "Effect": "Allow", "Action": "bedrock:GetPrompt", "Resource": "arn:aws:bedrock:*:*:prompt/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockKnowledgeBasePermissions", "Effect": "Allow", "Action": "bedrock:Retrieve", "Resource": "arn:aws:bedrock:*:*:knowledge-base/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockGuardrailPermissions", "Effect": "Allow", "Action": "bedrock:ApplyGuardrail", "Resource": "arn:aws:bedrock:*:*:guardrail/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockRetrieveAndGeneratePermissions", "Effect": "Allow", "Action": "bedrock:RetrieveAndGenerate", "Resource": "*" }, { "Sid": "AllowLambdaInvokeFunctionInProjectPermissions", "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockApplicationInferenceProfileAccessInProjectPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "AllowBedrockInvokeModelAccessWithInferenceProfilePermissions", "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockPromptKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com", "kms:EncryptionContext:aws:bedrock-prompts:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:prompt/*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockGuardrailKmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContext:aws:bedrock:guardrail-id": "false" } } } ] } } }, "createdDate": "2025-02-14T00:07:06.000Z", "lastUpdatedDate": "2025-03-12T18:37:06.000Z" }, "SageMakerStudioBedrockPromptUserRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockPromptUserRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-14T00:22:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockPromptReadOnlyPermissions", "Effect": "Allow", "Action": "bedrock:GetPrompt", "Resource": "arn:aws:bedrock:*:*:prompt/${aws:PrincipalTag/PromptId}:${aws:PrincipalTag/PromptVersion}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "S3ListPromptDefinitionPermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/PromptDefinitionPath}", "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/PromptDefinitionPath": "" } } }, { "Sid": "S3GetPromptDefinitionPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/PromptDefinitionPath}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/PromptDefinitionPath": "" } } }, { "Sid": "BedrockPromptKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "bedrock.*.amazonaws.com", "kms:EncryptionContext:aws:bedrock-prompts:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:prompt/${aws:PrincipalTag/PromptId}" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3KmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] } } }, "createdDate": "2025-02-14T00:22:06.000Z", "lastUpdatedDate": "2025-02-14T00:22:06.000Z" }, "SageMakerStudioBedrockEvaluationJobServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockEvaluationJobServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-14T00:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockEvaluationInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:GetInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockInvokeModelPermissions", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "BedrockModelInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:CreateModelInvocationJob", "bedrock:StopModelInvocationJob", "bedrock:GetProvisionedModelThroughput" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3GetBucketLocationPermissions", "Effect": "Allow", "Action": "s3:GetBucketLocation", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "" } } }, { "Sid": "S3ListBucketPermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "S3EvaluationPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "KmsDescribeKeyPermissions", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "S3KmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] } } }, "createdDate": "2025-02-14T00:37:06.000Z", "lastUpdatedDate": "2025-02-14T00:37:06.000Z" }, "SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-25T02:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockAppInferenceProfileInvocationPermissions", "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition": { "StringEquals": { "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "BedrockModelInvocationPermission", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition": { "Null": { "bedrock:InferenceProfileArn": "false" } } }, { "Sid": "OpenSearchServerlessPermissions", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "aoss:collection": "bedrock*" } } }, { "Sid": "ListDomainS3BucketPermissions", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "s3:prefix": [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "AccessDomainS3BucketPermissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "" } } }, { "Sid": "BedrockKnowledgeBaseKmsPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:knowledge-base/*" } } }, { "Sid": "S3KmsPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] } } }, "createdDate": "2025-02-25T02:52:07.000Z", "lastUpdatedDate": "2025-02-25T02:52:07.000Z" }, "SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-25T03:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "OpenSearchServerlessPermissions", "Effect": "Allow", "Action": "aoss:APIAccessAll", "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "aoss:collection": "bedrock*" } } }, { "Sid": "BedrockKnowledgeBasePermissions", "Effect": "Allow", "Action": [ "bedrock:GetIngestionJob", "bedrock:ListIngestionJobs", "bedrock:StartIngestionJob" ], "Resource": "arn:aws:bedrock:*:*:knowledge-base/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } } ] } } }, "createdDate": "2025-02-25T03:37:06.000Z", "lastUpdatedDate": "2025-02-25T03:37:06.000Z" }, "SageMakerStudioBedrockFunctionExecutionRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockFunctionExecutionRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-25T03:52:07.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "SecretsManagerReadPermissions", "Effect": "Allow", "Action": [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "KMSSameAccountBedrockViaSecretsManagerPermissions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": "secretsmanager.*.amazonaws.com", "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:${aws:PrincipalAccount}:secret:amazon-bedrock*" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2025-02-25T03:52:07.000Z", "lastUpdatedDate": "2025-02-25T03:52:07.000Z" }, "SageMakerStudioEMRInstanceRolePolicy": { "arn": "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-02-27T00:22:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "AccessCertificateLocationS3Permission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessPatchingRPMsS3Permission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::default-env-blueprint-*/*", "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*" ], "Condition": { "ArnLike": { "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint" }, "StringNotEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AccessBootstrapActionScriptS3Permission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AmazonDataZoneScopeName}/sys/emr/bootstrap-script/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AmazonDataZoneScopeName": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRClusterLogUploadS3Permission", "Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AmazonDataZoneScopeName}/sys/emr/*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/DomainBucketName": "", "aws:PrincipalTag/AmazonDataZoneDomain": "", "aws:PrincipalTag/AmazonDataZoneProject": "", "aws:PrincipalTag/AmazonDataZoneScopeName": "" }, "Null": { "aws:PrincipalTag/AmazonDataZoneProject": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EMRRuntimeRoleAssumePermissions", "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:TagSession" ], "Resource": "*", "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ "LakeFormationAuthorizedCaller" ] }, "StringEquals": { "iam:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid": "EMRKMSPermissions", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringLike": { "kms:ViaService": [ "ec2.*.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "Null": { "kms:EncryptionContextKeys": "false" } } }, { "Sid": "AllowGenerateDataKeyForEbsEncryption", "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } } }, "createdDate": "2025-02-27T00:22:06.000Z", "lastUpdatedDate": "2025-02-27T00:22:06.000Z" }, "AWSBackupSearchOperatorAccess": { "arn": "arn:aws:iam::aws:policy/AWSBackupSearchOperatorAccess", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2025-02-27T21:52:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "StartSearchAndListPermissions", "Effect": "Allow", "Action": [ "backup-search:StartSearchJob", "backup-search:ListSearchJobs", "backup-search:ListSearchResultExportJobs", "backup:ListIndexedRecoveryPointsForSearch" ], "Resource": "*" }, { "Sid": "BackupSearchRecoveryPointPermissions", "Effect": "Allow", "Action": [ "backup:SearchRecoveryPoint" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:backup:*:*:recovery-point:*" ] }, { "Sid": "SearchAndExportPermissions", "Effect": "Allow", "Action": [ "backup-search:StartSearchResultExportJob", "backup-search:StopSearchJob", "backup-search:GetSearchJob", "backup-search:GetSearchResultExportJob", "backup-search:ListSearchJobResults", "backup-search:ListSearchJobBackups" ], "Resource": [ "arn:aws:backup-search:*:*:search-job/*", "arn:aws:backup-search:*:*:search-export-job/*" ] }, { "Sid": "KMSDataKeyForSearchAndExportPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:backup-search:search-job" ] }, "StringLike": { "kms:ViaService": [ "backup.*.amazonaws.com" ] } } } ] } }, "v2": { "createdDate": "2025-02-27T21:52:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "StartSearchAndListPermissions", "Effect": "Allow", "Action": [ "backup-search:StartSearchJob", "backup-search:ListSearchJobs", "backup-search:ListSearchResultExportJobs", "backup:ListIndexedRecoveryPointsForSearch" ], "Resource": "*" }, { "Sid": "BackupSearchRecoveryPointPermissions", "Effect": "Allow", "Action": [ "backup:SearchRecoveryPoint" ], "Resource": [ "arn:aws:ec2:*::snapshot/*", "arn:aws:backup:*:*:recovery-point:*" ] }, { "Sid": "SearchAndExportPermissions", "Effect": "Allow", "Action": [ "backup-search:StartSearchResultExportJob", "backup-search:StopSearchJob", "backup-search:GetSearchJob", "backup-search:GetSearchResultExportJob", "backup-search:ListSearchJobResults", "backup-search:ListSearchJobBackups" ], "Resource": [ "arn:aws:backup-search:*:*:search-job/*", "arn:aws:backup-search:*:*:search-export-job/*" ] }, { "Sid": "KMSDataKeyForSearchAndExportPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "ForAllValues:StringEquals": { "kms:EncryptionContextKeys": [ "aws:backup-search:search-job" ] }, "StringLike": { "kms:ViaService": [ "backup.*.amazonaws.com" ] } } } ] } } }, "createdDate": "2025-02-27T21:52:06.000Z", "lastUpdatedDate": "2025-03-25T19:52:05.000Z" }, "AWSIoTManagedIntegrationsFullAccess": { "arn": "arn:aws:iam::aws:policy/AWSIoTManagedIntegrationsFullAccess", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-03-05T19:22:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iotmanagedintegrations:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/iotmanagedintegrations.amazonaws.com/AWSServiceRoleForIoTManagedIntegrations", "Condition": { "StringEquals": { "iam:AWSServiceName": "iotmanagedintegrations.amazonaws.com" } } } ] } } }, "createdDate": "2025-03-05T19:22:06.000Z", "lastUpdatedDate": "2025-03-05T19:22:06.000Z" }, "AWSIoTManagedIntegrationsRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSIoTManagedIntegrationsRolePolicy", "latestVersionId": "v1", "versionsCount": 1, "versions": { "v1": { "createdDate": "2025-03-05T21:22:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchLogs", "Effect": "Allow", "Action": [ "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/iotmanagedintegrations/*" ], "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } }, { "Sid": "CloudWatchStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/iotmanagedintegrations/*:log-stream:*" ], "Condition": { "StringEquals": { "aws:PrincipalAccount": "${aws:ResourceAccount}" } } }, { "Sid": "CloudWatchMetrics", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": [ "AWS/IoTManagedIntegrations", "AWS/Usage" ] } } } ] } } }, "createdDate": "2025-03-05T21:22:06.000Z", "lastUpdatedDate": "2025-03-05T21:22:06.000Z" }, "AmazonECSComputeServiceRolePolicy": { "arn": "arn:aws:iam::aws:policy/aws-service-role/AmazonECSComputeServiceRolePolicy", "latestVersionId": "v2", "versionsCount": 2, "versions": { "v1": { "createdDate": "2025-03-24T17:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyPermissionsForInstanceManagement", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeNetworkInterfaces" ], "Resource": "arn:aws:ec2:*:*:*/*" }, { "Sid": "ReadOnlyPermissionsForInstanceEventWindows", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceEventWindows" ], "Resource": "*" }, { "Sid": "ReadOnlyPermissionsForLaunchTemplates", "Effect": "Allow", "Action": [ "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*" }, { "Sid": "DeleteManagedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:ManagedResourceOperator": "ecs.amazonaws.com" } } }, { "Sid": "TerminateManagedInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ManagedResourceOperator": "ecs.amazonaws.com" } } } ] } }, "v2": { "createdDate": "2025-03-24T17:37:06.000Z", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "ReadOnlyPermissionsForInstanceManagement", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeNetworkInterfaces", "ec2:DescribeFleets" ], "Resource": "*" }, { "Sid": "ReadOnlyPermissionsForInstanceEventWindows", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceEventWindows" ], "Resource": "*" }, { "Sid": "ReadOnlyPermissionsForLaunchTemplates", "Effect": "Allow", "Action": [ "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions" ], "Resource": "*" }, { "Sid": "DeleteManagedLaunchTemplate", "Effect": "Allow", "Action": [ "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions" ], "Resource": "arn:aws:ec2:*:*:launch-template/*", "Condition": { "StringEquals": { "ec2:ManagedResourceOperator": "ecs.amazonaws.com" } } }, { "Sid": "TerminateManagedInstances", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringEquals": { "ec2:ManagedResourceOperator": "ecs.amazonaws.com" } } } ] } } }, "createdDate": "2025-03-24T17:37:06.000Z", "lastUpdatedDate": "2025-03-28T20:07:06.000Z" } }